Hackers behind the Coldcard hardware wallet exploit moved 64 Bitcoin worth $4.17 million and 200 Ether worth $380,000 into cryptocurrency mixers this week, according to blockchain security firm CertiK. The exploit has drained at least $100 million in Bitcoin across three confirmed waves, making it the third-largest crypto hack of 2026 so far. Canadian holders account for 25% of losses tracked in the breach, the largest share of any country, according to Bitcoin News.
Hackers tied to the Coldcard exploit sent 64 Bitcoin worth $4.17 million and 200 Ether worth $380,000 to cryptocurrency mixing protocols, according to blockchain security platform CertiK. The Bitcoin moved from address bc1q0 to the mixer Wasabi on Tuesday, while the Ether went to Tornado Cash on Wednesday.
According to a CertiK spokesperson: "There's likely a few copycats after the initial exploit." Mixers such as Tornado Cash pool and scramble cryptocurrency from multiple users, breaking the traceable onchain link between senders and recipients and lowering the odds of recovery.
Third-Largest Crypto Hack of 2026
The Coldcard exploit has become the third-largest cryptocurrency hack so far in 2026, draining at least $100 million in Bitcoin across three confirmed attack waves from 7,300 victim wallets, according to Galaxy Digital. The firm also flagged a suspected fourth wave that could push total losses to about $130 million in BTC.
A Five-Year-Old Firmware Flaw
TRM Labs said a firmware bug from March 2021 weakened seed randomness on some Coldcard wallets. The flaw cut key strength to 40 bits from 128 bits, leaving affected hardware wallet seed phrases vulnerable to brute-force attacks without physical access to the device. Dragonfly managing partner Haseeb Qureshi said roughly $2 of AI hardening could have prevented the exploit, citing social media reports that AI models rediscovered the vulnerability in under 20 minutes.
Canadian Holders Hit Hardest
Separately, Canadian bitcoin holders account for 25% of all attributable losses in the exploit, the largest share of any country, according to Bitcoin News. Australia ranks second, with 15% to 20% of total damages, while the United States and Thailand follow in the 10% to 15% range.
Sources: Cointelegraph, Bitcoin News
Trading involves risk.
Risk Disclaimer
