The perpetrator responsible for the security breaches affecting Coldcard bitcoin hardware wallets has transferred 45 percent of the funds pilfered during the third phase of attacks, according to statements from Galaxy Research.
Based on updates shared by the organization on the social media network X, Galaxy reported that the individual behind Wave 3 is actively shifting stolen bitcoin (BTC). Even though the hacker previously exchanged the coins for ether (ETH) through THORChain on September 2, they processed the captured bitcoin via CoinJoin transactions on Sunday. Altogether, 97.09 BTC, valued at $7.8 million based on Monday rates, has been utilized thus far.
The threat actor has been transferring the pilfered cryptocurrency in descending order of size, beginning with the largest amounts. Galaxy noted that ranks 1 through 11 have already been relocated, whereas the subsequent 10 unmanaged vaults contain 30.81 BTC, and the smaller vaults spanning ranks 61 to 293 collectively hold 33.77 BTC.
Regarding the overall amount of funds taken from Coldcard units, 82 percent is still held in the initial addresses controlled by the hacker, while the remainder has been shifted for money laundering objectives, Galaxy further stated.
The heists, which began on July 30, originated from a firmware flaw introduced by Coinkite back in 2021. This vulnerability impacted the mechanism by which Coldcard hardware generated wallet seeds, lowering the entropy utilized for their creation and enabling malicious actors to brute-force private seed phrases and empty single-signature addresses without ever accessing the hardware device.
By the middle of August, Galaxy stated it had tracked approximately 1,779 BTC stolen across 190 victims and over 8,600 addresses. The research organization highlighted the potential existence of a Wave 4, although it has not been verified yet.
In the update published on Monday, Galaxy pointed out that the attacker jointly spent an undiscovered vault made up of 58 addresses that likely belong to Coldcard victims. Factoring this in would elevate aggregate damages to 1,806 BTC, translating to $143.9 million at current market valuations.
Originally published at https://www.theblock.co/news/defi/2026-09-07-coldcard-exploiter-moves-wave-3-413661.
