The Coldcard Wave 3 attacker has moved 97.09 BTC, roughly 45% of the haul and about $7.7 million, through cross-chain swaps and mixing, on-chain researchers said Monday.
Galaxy Research, which has tracked the exploit chain since the thefts began July 30, wrote in a post on X that the Wave 3 exploiter “continues to move funds.” The first exit came September 2, when about 20.5 BTC from the attacker’s largest vault was routed through decentralized exchange THORChain, with the proceeds landing on Ethereum. CoinJoin rounds, which combine multiple users’ payments into one transaction to make funds harder to trace, followed on September 5 and 6: 15.48 BTC from the second-largest vault, then 61.12 BTC from 10 more vaults.
The laundering marks a shift from accumulation to cash-out. The attacker built 293 two-of-two multisignature vaults, one per victim, and has been draining them in order of size; the 11 largest are now empty. The next 10 untouched vaults hold 30.81 BTC, and the 233 smallest hold 33.77 BTC combined, per Galaxy’s September 7 tally.
Across all waves of the Coldcard exploit, roughly 82% of the stolen bitcoin still sits at original attacker-controlled addresses, with 18% moved through transactions Galaxy describes as designed to obscure the trail. The wider haul is estimated at roughly 1,806 BTC, about $143.9 million, though that total is conditional: it includes a newly flagged vault funded by 58 addresses that Galaxy believes belongs to another Coldcard victim but whose origin remains unconfirmed.
The thefts stem from a firmware bug Coinkite shipped in March 2021 in version 4.0.1 onward, which reduced the randomness used to generate wallet seeds to as little as 40 bits of effective entropy, down from 128, making the seed phrases brute-forceable. Coinkite has released fixed firmware, but the company has said affected owners must create new seeds and move their funds, since an update cannot repair an already-compromised seed.
Galaxy has shared identified attacker addresses with law enforcement agencies and industry partners. Its researchers have engaged directly with more than 190 victims, according to the firm’s posts on X.
