Hassan Maishera
TL;DR
-
The Coldcard attacker has moved 45% of the Bitcoin stolen during the third wave of attacks, according to Galaxy Research.
-
Approximately 97.09 BTC, worth $7.8 million, has been transferred through CoinJoin transactions.
-
Galaxy estimates that 82% of all stolen funds remain in the attacker’s original addresses.
-
A previously unidentified group of 58 addresses could raise total losses to 1,806 BTC, or approximately $143.9 million.
The attacker behind a series of exploits targeting Coldcard Bitcoin hardware wallets has moved approximately 45% of the assets stolen during the third wave of attacks, according to Galaxy Research.
In a series of posts on X, Galaxy said the operator responsible for Wave 3 continues to transfer the stolen bitcoin.
Coldcard ‘Wave 3’ exploiter continues to move funds
— Galaxy Research (@glxyresearch) September 7, 2026
In wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim’s coins.
The first movements on 9/2 sent coins over THORChain to Ethereum.
Tonight’s movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah
The attacker previously exchanged some of the funds for ether through THORChain on September 2. On Sunday, the operator instead moved the stolen BTC through CoinJoin transactions, a method that combines multiple transactions to make the movement of funds more difficult to trace.
Galaxy said the attacker has so far spent 97.09 BTC, valued at approximately $7.8 million at Monday’s prices.
Attacker Targets Largest Vaults First
The attacker appears to be moving the stolen funds according to the size of each compromised vault, beginning with the largest balances.
Galaxy said the 11 largest vaults had already been moved. The next 10 untouched vaults collectively held 30.81 BTC, while the smaller vaults ranked between 61 and 293 contained a combined 33.77 BTC.
Across the entire Coldcard exploit, approximately 82% of the stolen bitcoin remained in the original attacker-controlled addresses. The remaining 18% had been transferred as part of apparent laundering efforts, according to Galaxy.
The latest activity indicates that the attacker is gradually consolidating or obscuring the stolen funds rather than moving all of the bitcoin at once.
The thefts began on July 30 and were traced to a firmware flaw introduced by Coldcard manufacturer Coinkite in 2021.
The vulnerability affected the way certain Coldcard devices generated wallet seeds. It reduced the amount of randomness used during the process, making some seed phrases significantly easier to predict.
Attackers could consequently use brute-force techniques to reconstruct affected private seed phrases and drain vulnerable single-signature Bitcoin addresses. They did not need physical access to the hardware wallet to carry out the theft.
The incident highlights the consequences of weak randomness in cryptocurrency security. Even when private keys are stored offline, predictable seed generation can allow an attacker to reproduce those keys remotely.
Estimated Losses Rise to 1,806 BTC
By mid-August, Galaxy had identified approximately 1,779 BTC stolen from 190 victims across more than 8,600 addresses.
The research firm had also raised the possibility of a fourth wave of attacks, although it had not confirmed one.
Galaxy’s latest analysis identified a previously unknown vault consisting of 58 addresses that were co-spent by the exploiter. The firm believes those addresses likely belonged to additional Coldcard victims.
Including the newly identified vault would increase the estimated losses to 1,806 BTC, worth approximately $143.9 million at current prices.
The revised figure remains an estimate because Galaxy has not definitively confirmed that every newly identified address was affected by the Coldcard vulnerability. However, the shared spending activity suggests the addresses were likely controlled by the same attacker.
