The attacker behind the third wave of Coldcard hardware-wallet thefts has drained the 11 largest compromised vaults, moving roughly 45% of the stolen bitcoin (BTC). That is about $7.7 million, according to Galaxy Research.
Galaxy has been tracing the on-chain movements. The third-wave exploiter created 293 two-of-two multisignature vaults to hold victims’ coins and began emptying them in descending order of size. Funds from the 11 largest vaults have now been moved. The update was published Sept. 7.
On Sept. 2, the attacker started routing funds to Ethereum through the THORChain bridge. Then came CoinJoin rounds, transactions that merge multiple users’ payments into a single batch to obscure the trail. Galaxy described the movements as apparent laundering.
Across all three waves of the Coldcard exploit, Galaxy has identified approximately 1,779 BTC stolen from roughly 190 victims spread across more than 8,600 addresses. About 82% of that haul remains in the original attacker-controlled addresses. The remaining 18% has moved.
Holders, as ever, are divided on whether that 82% sitting still is a comfort or a countdown.
Galaxy said the latest transactions also surfaced a previously unknown vault likely holding another Coldcard victim’s funds. The cause of that loss remained unconfirmed. The firm did not name the victim or specify the amount.
The Coldcard exploit ranks as the third-largest crypto hack of 2026 so far. Only two breaches were bigger: a $293 million Kelp DAO breach and the $280 million Drift protocol hack, according to DefiLlama.
What is not known: the total BTC stolen in wave 3 specifically, the start dates of each wave, the initial compromise method, the attacker’s identity, and whether any victim funds have been recovered. Galaxy has not published a recovery timeline. Coldcard has not commented publicly on the third-wave movements, according to the fetched reports.
How the attacker gained control of the devices and set up vaults the victims could not independently move remains the open question neither report answers.
