Galaxy Research said the attacker behind the "third wave" of the Coldcard hardware wallet theft is still moving funds. According to the team, the attacker set up 293 separate 2-of-2 multisig vaults for victim funds in this wave and has been processing them in descending order by stolen amount. The first batch was bridged through THORChain to Ethereum on Sept. 2 and has more recently entered the mixing process.
Galaxy Research said the attacker has already moved vaults ranked No. 1 through No. 11. The next 10 untouched vaults hold a combined 30.81 BTC, while vaults ranked No. 61 through No. 293 hold a combined 33.77 BTC. Based on its tracking, roughly 45% of the third-wave stolen coins have now been moved.
The team also said the latest transfers exposed 58 previously unknown vault addresses. Those addresses were spent jointly using the same 2-of-2 multisig format seen in the third wave and were then routed by the same attacker into hop addresses that fund CoinJoin transactions. Galaxy Research said those funds likely also belong to Coldcard victims, pushing the estimated total stolen through the disclosed Coldcard vulnerability to about 1,806 BTC. At present, around 82% of the stolen BTC remains at the attacker’s original addresses, while about 18% has been moved.
Galaxy Research said on X that the attacker tied to the "third wave" of the Coldcard hardware wallet theft is still moving funds.
The attacker has moved the top 11 vaults by stolen amount
According to Galaxy Research, the attacker created 293 separate 2-of-2 multisig vaults for victim funds in this wave. The first batch was moved through THORChain to Ethereum on Sept. 2. More recently, those funds entered the mixing process.
The team said the attacker is working through the largest holdings first, based on the ranking of stolen amounts, and has already moved vaults ranked No. 1 through No. 11.
- The next 10 untouched vaults hold a combined 30.81 BTC.
- Vaults ranked No. 61 through No. 293 hold a combined 33.77 BTC.
Galaxy Research said about 45% of the coins stolen in the third wave have now been moved.
58 previously unknown vault addresses were identified
The latest transfers also revealed previously unknown vaults. Galaxy Research said 58 addresses were spent jointly using the same 2-of-2 multisig structure seen in the third wave. The same attacker then routed those funds into hop addresses used to fund CoinJoin transactions.
The team said those addresses likely also belong to Coldcard victims. That would raise the previously disclosed total stolen through the Coldcard vulnerability to about 1,806 BTC.
Most stolen BTC remains at the attacker’s original addresses
Galaxy Research said about 82% of the stolen BTC is still sitting in addresses first controlled by the attacker, while about 18% has already been moved.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
