Coldcard-Linked Hacker Moves $7.7M in Bitcoin, About Half of a Third Tranche

A hacker tied to a Coldcard-linked bitcoin theft moved roughly $7.7 million in BTC — described as nearly half of a third wave of stolen coins on the move — according to Decrypt, which published the report on September 7, 2026. Bitcoin was trading at about $79,433 on Decrypt's price ticker at the time.

Beyond that, the specifics are thin. The exact wallets, the destination of the funds, the method used to track them, and the total size of the original theft weren't laid out in the report at hand. The "third-wave" framing implies the money is being shifted in staged batches — a pattern common when someone is trying to move a large, tainted balance without lighting up every exchange's compliance desk at once. If $7.7 million is "nearly half" of the third tranche, the arithmetic points to a third batch of roughly $15–16 million, but that is an inference from the headline framing, not a figure anyone has confirmed.

Coldcard is a bitcoin-only hardware wallet made by Coinkite. It's worth stating plainly what the reporting does not: there is no confirmation here that Coldcard's hardware was itself broken. "Coldcard hacker" is a label attached to whoever controls these coins, not a verified claim about a device flaw versus a phishing, seed-phrase, or supply-chain compromise. Treat the distinction as open.

Key facts

• ~$7.7M in BTC moved by a Coldcard-linked hacker, called nearly half of a third-wave haul — Decrypt, Sept. 7, 2026.
• BTC price ~$79,433 at the time — Decrypt price ticker.
• Total original theft, victim(s), destination wallets, and tracking method: not disclosed in the available reporting.

The real-world read

This is a single secondary report, and the underlying on-chain evidence — transaction hashes, address clusters, the analytics firm doing the tracing — isn't cited in what's available. That doesn't make it wrong; it makes it unverified at the primary-source level. Anyone wanting to trust the $7.7 million figure should want to see the chain data behind it.

The "wave" language is the tell worth watching: staged movement usually means laundering or off-ramping in progress, not a one-off slip. And the loose phrase "Coldcard hacker" risks doing more work than the facts support — it can read as an indictment of the hardware when the reporting establishes no such thing. Until a total haul and a clear compromise vector are confirmed, the honest position is: coins are moving, the number is a secondhand estimate, and the cause is unstated.

Opinion, and whose

No forecasts, price calls, or attributed analysis appear in the available reporting — so there's nothing to attribute here. Any claim about who the hacker is, whether the funds will be recovered, or what it means for Coldcard users would be speculation.

Sources

• Decrypt (secondary) — reported the $7.7M movement, the "nearly half of third-wave haul" framing, and the ~$79,433 BTC price via its ticker. Not marketing or sponsored. No primary on-chain source was cited within it.

This is news, not financial advice.