ChainThink reports that on August 2, according to on-chain analytics firm Galaxy Research, the ColdCard wallet hacking incident has escalated to its third wave, with an additional 207.73 BTC stolen.
The three waves of attacks have collectively stolen 1,367.05 BTC, approximately $88.6 million, affecting 4,585 addresses.
On-chain data shows that the three attacks exhibit high similarity in fund aggregation topology, P2WPKH target addresses, and derivation paths, with each wave occurring approximately 27 hours apart, suggesting they may be the work of the same attacker—though no direct evidence has been confirmed.
Galaxy Research states that all terminal addresses controlled by the hacker currently hold a total of 1,366.39 BTC, all of which remain unspent on-chain.
The above data is based solely on analysis of Bitcoin block data and the UTXO set, and has not yet been computationally verified to determine whether the affected addresses are vulnerable due to low-entropy generation.