Coldcard Hacker Moves 45% of Wave 3 Loot, Most Funds Remain Untouched

The hacker linked to the third wave of attacks on Coldcard wallets has started moving the stolen coins. According to Galaxy Research, the exploiter has transferred about 45% of the Wave 3 loot. The funds were moved either to Ethereum through THORChain or into Coinjoin in an attempt to launder the assets.

The hacker created 293 2-of-2 multisig vaults for victims' coins during Wave 3, and it appears that most of the stolen funds are still held in the attacker-controlled addresses where they were initially stored. Approximately 82% of the stolen coins across all waves remain untouched.

Galaxy Research identified a previously unknown vault linked to 58 addresses likely associated with Coldcard victims following the latest transactions. The attack began on July 30, 2026, and targeted Coldcard wallets due to a firmware flaw that existed since March 2021.