Coldcard Hacker Moves Half of Wave 3 Bitcoin Stolen

The hacker behind the Coldcard hardware wallet exploits has moved nearly half of the Bitcoin stolen in the third wave of attacks, according to Galaxy Research. The attacker has routed the stolen funds through CoinJoin transactions, making it harder for investigators to track their movements.

Galaxy estimates that 97.09 BTC worth around $7.8 million have been spent from the Wave 3 funds so far. The exploiter is moving the stolen Bitcoin according to the size of each victim vault, starting with the largest holdings.

The attacks began on July 30 and were linked to a firmware vulnerability introduced by Coinkite in 2021. Galaxy has identified approximately 1,779 BTC stolen from 190 victims across more than 8,600 addresses.