An attacker linked to the Coldcard hardware wallet breach has moved roughly $7.7 million in stolen Bitcoin, about half of the funds associated with the latest "third wave" of the theft, according to Decrypt. The proceeds were divided among 293 separate on-chain vaults and are being emptied sequentially from the largest downward. That pattern indicates a scripted, staged operation rather than a single rapid liquidation and makes recovery more difficult by creating multiple parallel transaction flows. Bitcoin traded around $79,395 on September 7, 2026, down about 0.7% on the day, giving the transferred amount substantial spot value. Coldcard is an air-gapped hardware wallet (offline key-storage device) designed to keep private keys away from internet-connected computers, but it cannot prevent unauthorized actions if a seed phrase is exposed, an owner is deceived into signing, or the surrounding operating process is compromised. The incident underscores that hardware wallets protect key material, while users, backups and transaction-approval procedures remain critical security boundaries. Verifying addresses on the device and treating requests to re-enter or "validate" a recovery phrase as hostile remain the key practical safeguards.