Coldcard Hacker Strikes $7.7M, Almost Half of Third-Wave Bitcoin Haul – Decrypt

In short
Galaxy Analysis mentioned Monday that 97.09 BTC, value about $7.7 million, has left the Wave 3 vaults.
The cash went out via THORChain on September 2 and into CoinJoin rounds over the weekend.
Throughout the entire Coldcard exploit, 82% of the stolen Bitcoin has nonetheless not moved.
The attacker behind the third wave of thefts from Coldcard {hardware} wallets has moved 97.09 BTC, roughly 45% of that wave's haul and about $7.7 million at Monday's costs, in response to Galaxy Analysis.The primary exit got here on September 2, when round 20.5 BTC from the biggest vault went via THORChain and got here out as Ethereum. The cash spent on Sunday evening went into CoinJoin rounds as a substitute, a Bitcoin privateness approach that swimming pools transactions from a number of customers to interrupt the path between inputs and outputs. Solely 20.56 BTC really reached Ethereum. One other 57.24 BTC is sitting unspent as CoinJoin change in a single deal with, and Galaxy says its path ends on roughly 19 BTC extra.
Coldcard ‘Wave 3’ exploiter continues to maneuver funds
In wave 3, the exploiter created 293 2-of-2 multisig vaults for every sufferer’s cash.
The primary actions on 9/2 despatched cash over THORChain to Ethereum.
Tonight’s actions are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah
— Galaxy Analysis (@glxyresearch) September 7, 2026The vaults are the attacker's personal building. Galaxy mentioned the operator constructed 293 two-of-two multisig addresses and has been working via them so as of dimension. Eleven are actually empty. The following ten maintain 30.81 BTC between them, and the 233 smallest maintain 33.77 BTC.BitcoinBTC · USD$79,402−0.65percent24H7D1M1YYTD12:00 PM06:00 PM12:00 AM05:45 AM11:45 AM$80.4k$80.0k$79.7k$79.3k24h HighHigh$80,49424h LowLow$79,081VolVol$830.9MMarket projectionsOdds by MyriadA flaw shipped in 2021The thefts hint to a firmware bug Coinkite launched in March 2021, which rerouted seed era off the system's {hardware} random-number chip and onto a software program stand-in, collapsing key energy from 128 bits of entropy to as little as 40. That permit attackers reconstruct personal keys offline and drain single-signature addresses with out ever touching the {hardware}. The sweeps started on July 30.Coinkite has overhauled the firmware, now at Mk4/Mk5 5.6.2 and Q 1.5.2Q, requiring homeowners to provide their very own randomness via key presses, cube rolls or coin flips. An replace nonetheless can not restore a seed generated underneath the flawed model, and anybody whose pockets was created on affected firmware has to generate a recent seed and transfer their cash to it. Coinkite chief govt Rodolfo Novak apologized in an open letter on July 31, writing that the corporate must “earn again our customers' belief.” A full technical postmortem remains to be in preparation.Myriad: Bitcoin subsequent value transfer? Click on to make your prediction.Monday's thread additionally flagged a beforehand unknown vault fed by 58 addresses. Galaxy marks its trigger as open however believes it one other Coldcard sufferer, which might raise its revealed whole for the exploit to about 1,806 BTC, or $143.9 million. Galaxy mentioned in August it was additionally carrying an unconfirmed fourth wave of 638.5 BTC, which might take the full previous 2,400, and had logged no attacker sweeps since August 6. Throughout all waves, 82% of the cash stay the place the attackers first put them.Each day Debrief NewsletterStart day by day with the highest information tales proper now, plus authentic options, a podcast, movies and extra.