TheBlock
The attacker behind the Coldcard bitcoin hardware wallet exploits has already moved 45% of stolen assets from the third wave of attacks, according to Galaxy Research, which posted its latest on-chain tracking of the laundering operation on Monday. About 97.09 BTC, worth roughly $7.8 million at current prices, has been spent so far in Wave 3, while around 82% of total stolen funds across all waves still sit in the attacker's original addresses.
Why it matters
The thefts date back to July 30 and trace to a firmware vulnerability Coinkite shipped in 2021. That bug weakened how Coldcard devices generated wallet seeds, reducing the randomness used in seed creation and letting attackers brute-force private seed phrases to drain single-signature addresses without ever touching the physical device. By mid-August, Galaxy had identified roughly 1,779 BTC stolen across 190 victims and more than 8,600 addresses. Monday's update added a previously unknown "co-spent" vault of 58 addresses, likely more Coldcard victims, pushing the running total to 1,806 BTC, or $143.9 million at current prices.
Market impact
The laundering pattern itself is the news. The Wave 3 operator first swapped stolen BTC into ETH through THORChain on September 2, then ran the coins through CoinJoin on Sunday, and is now peeling the stash off in size order, largest vaults first. Galaxy said ranks 1 through 11 have been touched, while the next 10 untouched vaults hold 30.81 BTC and the smallest tier (ranks 61 through 293) holds another 33.77 BTC combined. Galaxy has not ruled out a fourth wave of attacks.
Frequently asked questions
-
How much bitcoin has the Coldcard exploit stolen in total?
Galaxy's Monday update puts total losses at 1,806 BTC, worth about $143.9 million at current prices, after a previously unknown vault of 58 victim addresses surfaced.
-
How did attackers drain Coldcard wallets without touching the device?
A firmware bug Coinkite shipped in 2021 reduced randomness in seed generation. Attackers brute-forced private seed phrases and emptied single-signature addresses remotely.
-
How is the Wave 3 attacker laundering the stolen bitcoin?
The operator swapped coins into ETH via THORChain on September 2, then ran them through CoinJoin on Sunday. About 97.09 BTC ($7.8M) has been spent so far in Wave 3.
-
Could there be a Wave 4 of Coldcard exploits?
Galaxy Research has mentioned the possibility but has not confirmed a fourth wave. The firm continues to monitor the attacker's addresses for fresh movement.
-
Why is the stolen bitcoin being moved in size order?
Galaxy said the Wave 3 operator is peeling the stash off largest vaults first. Ranks 1-11 are already moved, with the next 10 vaults and smaller clusters still untouched.
WatcherGuru
CoinTelegraph
CoinDesk
Lookonchain
WuBlockchain
CryptoSlate