The Coldcard exploiter moved 97.09 Bitcoin, valued at approximately $7.8 million at Monday's prices, according to on-chain analysis from Galaxy Research. This transfer represents 45 percent of the Bitcoin stolen in the third wave of attacks against Coldcard hardware wallets.
The movement began Sept. 2, with the attacker directing stolen Bitcoin through THORChain. The funds were swapped for Ether in a cross-chain transaction, marking the first significant activity from the Coldcard hacks after a period of dormancy.
Over the past weekend, the attacker intensified efforts to obscure the fund trail by funneling additional Bitcoin through CoinJoin, a transaction mixer that aggregates inputs from multiple users to complicate on-chain tracing.
Galaxy Research indicates the attacker is systematically draining funds from the largest affected vaults down to the smallest. Vaults ranked one through 11 have been fully emptied. The next 10 untouched vaults currently hold approximately 30.81 BTC combined.
Earlier investigations by Galaxy Research identified approximately 1,778.84 BTC stolen from more than 8,600 addresses belonging to 190 confirmed victims as of mid-August. More recent tracking places the total at roughly 1,789 BTC, with an additional cluster of addresses potentially pushing the compromise to approximately 1,806 BTC.
The Coldcard incident stemmed from a firmware vulnerability that caused affected wallets to generate insufficiently random seeds, allowing attackers to deduce private keys remotely and drain Bitcoin without requiring physical device access.
About 82 percent of the stolen Bitcoin remains in the attacker's wallets, according to Galaxy's latest figures. The remaining 18 percent has been moved in patterns consistent with money laundering.
Coldcard has advised all users holding funds in potentially vulnerable wallets to transfer their assets immediately.
