Coldcard Hacker Moves $7.7M in BTC, 45% of Stolen Bitcoin in Third Attack Wave

The attacker behind the third wave of Coldcard hardware wallet thefts has moved 97.09 BTC, valued at approximately $7.7 million, representing roughly 45% of the bitcoin stolen in this specific wave. According to Galaxy Research, the hacker has successfully drained the 11 largest vaults associated with the exploit, utilizing decentralized exchange THORChain and CoinJoin transactions to obscure the movement of funds across the blockchain.

Market Context

The thefts originated on July 30, following the discovery of a firmware flaw in Coldcard devices that weakened the randomness used to generate wallet seeds. This vulnerability allowed attackers to compromise user funds, leading to a wider exploit totaling approximately 1,806 BTC. While Coinkite has released fixed firmware, the company stated that affected users must generate new seeds and move their funds, as a software update alone cannot repair wallets already compromised by the initial flaw.

Analysis

Galaxy Research’s on-chain analysis indicates the attacker is methodically working through 293 vaults in order of size. The vaults themselves are not the victims' original wallets but were created by the exploiter using a two-of-two multisignature setup that requires two keys to move the bitcoin. The attacker routed about 20.5 BTC from the largest vault through THORChain on Sept. 2, with the proceeds landing on Ethereum. Subsequently, 15.48 BTC was sent into a CoinJoin transaction on Sept. 5, followed by another 61.12 BTC from 10 vaults the next day. CoinJoin combines bitcoin transactions from multiple users, making it significantly harder to link specific inputs with their eventual outputs.

Key Numbers

- 97.09 BTC ($7.7 million) moved by the attacker in the third wave, representing 45% of that wave's stolen funds.

- 11 largest vaults drained out of a total of 293 identified vaults in the third wave.

- 20.5 BTC routed through THORChain on Sept. 2, landing on Ethereum.

- 15.48 BTC moved via CoinJoin on Sept. 5; 61.12 BTC moved from 10 vaults on Sept. 6.

- The next 10 largest vaults hold 30.81 BTC combined.

- Vaults ranked 61 through 293 contain a combined 33.77 BTC.

- Total wider exploit size is approximately 1,806 BTC, worth roughly $143.9 million.

- 82% of bitcoin taken across all waves remains at original attacker-controlled addresses; 18% has moved in obscuring transactions.

What to Watch

Traders should monitor the remaining 18% of stolen funds that have already moved, as well as the 82% currently held at original attacker-controlled addresses. Key upcoming catalysts include potential exchange delistings or account freezes by major custodians attempting to block the laundering pipeline, particularly on Ethereum where THORChain proceeds have landed. Market watchers will also track broader crypto sentiment shifts as the community assesses the residual risk of the 1,806 BTC exploit and the effectiveness of Coinkite's mitigation strategies.