Crypto News
Stolen Bitcoin linked to a Coldcard hack moved $1.94 million for the first time, putting the funds under fresh on-chain scrutiny. The transfer raises the possibility of a cash-out, but does not establish that the coins have been sold or sent to an exchange.
Why it matters
Movement of stolen BTC is a security signal before it is a market signal. The first transfer makes the destination and any subsequent routing important to track, but the movement alone does not establish a sale. For Bitcoin markets, the concrete development is renewed activity in $1.94 million of stolen funds, not a completed cash-out.
Market impact
Coldcard's July 31, 2026 security alert tells Mk3 users to begin a careful migration if their seed was generated on version 4.0.1 or later without at least 50 private, independent dice rolls. Mk4 and Mk5 devices below 5.6.0, and Q devices below 1.5.0Q, should update first, generate a new seed, then migrate. The next meaningful on-chain signal is whether the moved Bitcoin reaches an exchange or another conversion route.
Frequently asked questions
-
Does the $1.94M Bitcoin movement confirm that a cash-out has started?
No. The movement puts the stolen funds under on-chain scrutiny, but it does not establish that the coins were sold or sent to an exchange.
-
What should an affected Mk3 Coldcard user do?
If the seed was generated on version 4.0.1 or later without at least 50 private, independent dice rolls, Coldcard's guidance is to begin a careful migration.
-
Which Coldcard device versions need an update before migration?
Mk4 and Mk5 devices below 5.6.0, and Q devices below 1.5.0Q, should update first, generate a new seed, and then migrate.
-
What on-chain development should markets watch next?
The next meaningful signal is whether the moved Bitcoin reaches an exchange or another conversion route.
-
When did Coldcard issue the security alert?
The alert was dated July 31, 2026.
TheBlock
CoinDesk
Crypto Rank News
CryptoSlate
Lookonchain
CoinTelegraph
WuBlockchain