Galaxy Reports Coldcard Wave 3 Hacker Moves 45% of Stolen Bitcoin

The attacker behind the third wave of Coldcard Bitcoin wallet thefts has moved 45% of the funds stolen in that phase, with 97.09 BTC worth $7.8 million at Monday’s prices spent so far, Galaxy Research said in its analysis.

In posts on social media platform X, Galaxy said the latest activity involved CoinJoin transactions on Sunday, following an earlier move on Sept. 2 in which the exploiter swapped stolen Bitcoin into Ethereum through THORChain. The research firm said the operator continues to move the stolen coins.

Galaxy’s tracking shows the attacker has been moving the stolen holdings from the largest vaults to the smallest. Vaults ranked 1 through 11 have already been moved, while the next 10 untouched vaults contain a combined 30.81 BTC. Another 33.77 BTC is spread across the smaller vaults ranked 61 through 293.

In its Monday post, Galaxy also linked the operator to a previously unidentified vault comprising 58 addresses that the research firm said are likely associated with Coldcard victims. If those addresses are included, the amount stolen across the Coldcard attacks would rise to 1,806 BTC, equivalent to $143.9 million at current prices.

Across the overall exploit, 82% of the stolen funds remain in the original addresses controlled by the attackers. Galaxy said the remainder has been moved for laundering purposes.

The thefts began on July 30 and originated from a firmware bug that Coinkite shipped in 2021. The flaw reduced the randomness used when Coldcard devices generated wallet seeds, enabling attackers to brute-force private seed phrases and drain single-signature addresses without accessing the devices themselves.

By mid-August, Galaxy had identified roughly 1,779 BTC taken from 190 victims and more than 8,600 addresses. The research firm has also raised the possibility of a fourth wave of thefts, although it has not confirmed one.