$327M Bitcoin Stolen in a Week as Hackers Target Coldcard Wallets and Liquid Network Used by Exchanges

In two separate crypto security incidents over the past week, a total of $327.7 million worth of bitcoins were moved out from hardware cryptocurrency wallets and a settlement network used by major crypto exchanges. In a third wave of attack on Coldcard hardware wallets, the hacker transferred 97.09 bitcoins worth around $7.7 million via multiple sophisticated methods. Galaxy Research explained in a Monday X post that the hacker or the hacker group first routed 20.5 BTC from its biggest vault through the THORChain decentralised exchange on 2nd September and converted them into Ethereum. Coldcard 'Wave 3' exploiter continues to move funds In wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim's coins. The first movements on 9/2 sent coins over THORChain to Ethereum. Tonight's movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah Again on 5th September, the attacker sent 15.48 bitcoins from Coldcard's second-largest vault into a CoinJoin transaction, and ramped up the transfers to 61.12 BTC from 10 vaults on the following day. According to Galaxy, the hacker has been working through 293 vaults and has now completely drained the 11 largest. The next 10 vaults have 30.81 BTC, and vaults ranked 61 through 293 hold 33.77 BTC. Note that the vaults are not victim wallets, but created by the hacker for each victim's holdings by leveraging a two-of-two multisignature setup, which needs two keys to transfer bitcoin. Around 82% of the stolen bitcoin across all waves of attacks on Coldcard wallets remains at original attacker-controlled addresses, while 18% has moved in trades likely designed to obscure the funds' trail, according to Galaxy Research. The thefts first began on 30th July after hackers targeted a security flaw that weakened the randomness used by Coldcard devices to generate wallet seeds. Note that hardware wallets are more secure than online vaults by design. Approximately 4,000 of the roughly 4,200 BTC held in Liquid Network's federation wallet were withdrawn by actors who claimed to be white-hat hackers. According to media outlets, the wallet is overseen by more than 80 exchanges and asset managers. The network offers a settlement layer used by exchanges to overcome the slow speed of the bitcoin blockchain. We are aware of a security incident on @Liquid_BTC . Purported white-hat hackers have withdrawn ~4,000 BTC (~$320 million) from the Liquid Federation wallet. The @Blockstream team is working on contacting them on-chain with a signed message. What we know so far is that the funds… Liquid Network confirmed that wallets will be impacted, and that new transactions were now halted until federation members restore normal network activity. Liquid Network issues L-BTC against bitcoin locked in reserve for faster trade settlements. Now, the hack raises concerns about the overall security of the system. The stolen bitcoins were reportedly moved out through the SideSwap trading platform by exploiting a system bug at the node level in Liquid's transaction software. The white hat hacker is reportedly offering to return the stolen funds once the vulnerability is fixed, and communicating with network maintainers via onchain Bitcoin transactions. 'Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix,' one message said, according to a media outlet. These events have mounted pressure on the overall cryptocurrency market, with liquidations surging by over 83% in the past 24 hours to $370.9 million. Popular cryptocurrencies like Bitcoin, Ethereum, XRP, Solana , and BNB were trading in the red. Bitcoin prices continued to hold above the $79,000 level. Crypto hacks are evolving from stealing passkeys to directly bypassing security infrastructure amid the emergence of more intelligent systems worldwide.