Movement on Coldcard stolen-fund addresses.
CONFIRMED OUT — 64.90373764 BTC left
bc1q0rvn88w08j75k4h48lf9fvhan7unjp7vjf5q6m (Aug 2 vault)
balance 64.90373764 -> 0.00000000
CONFIRMED OUT — 2.02374869 BTC left
342L6n3b61n1CGoh8wCzuzyXUvyZTSjZtz (Wave 4 park)
balance 2.02374869 -> 0.00000000
CONFIRMED OUT — 1.09429601 BTC left
36XfMDAYuCn76DDJt5HV6kJxCukb1F1x3G (Wave 4 park)
balance 1.09429601 -> 0.00000000
CONFIRMED OUT — 0.96227191 BTC left
34nHYNnc9DLxo3iCzvSHiyD2YsC3jP4qDQ (Wave 4 park)
balance 0.96227191 -> 0.00000000
Watching the 99 addresses published on coldcard-hack-tracker.vercel.app, all public chain data via mempool.space.
Alert directions are deliberate. A SPEND fires whenever a tracked address appears as a transaction INPUT. An INBOUND only fires above 0.01 BTC — these are the attacker's holdings, so a large arrival is a fresh consolidation, while the 546-sat dusting of the largest stash is noise and stays silent.
Currently held across tracked addresses: 1360.82656171 BTC. Ever received: 1999.63160741 BTC.
The tracker operator is tagged on this note.
