Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says
As of mid-August, Galaxy said it had identified roughly 1,779 BTC stolen from 190 victims and more than 8,600 addresses.
The third wave of the Coldcard wallet hacking attack has resulted in the movement of approximately 45% of the stolen Bitcoin (BTC), according to Galaxy Research. The attacker has been routing the funds through THORChain and into CoinJoin transactions to launder the stolen assets. Galaxy reports that the exploiter initiated the fund transfers to Ethereum on September 2.
By creating 293 two-of-two multisignature vaults, the attacker has moved funds from the largest vaults, in descending order of size. So far, the transactions have moved the funds from the 11 largest vaults. By analyzing these movements, Galaxy identified a previously unknown vault that likely held another Coldcard victim's funds, though the cause of this loss remains unverified.
In total, about 82% of the stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has been moved, likely for the purpose of laundering. The Coldcard exploit is currently the third-largest of its kind in 2026, surpassed only by a $293 million Kelp DAO hack and a $280 million Drift protocol hack, as reported by DefiLlama.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
