An attacker has moved $7.7 million in bitcoin tied to the third wave of Coldcard thefts, according to Galaxy Research. The funds represent 45% of the bitcoin stolen in that wave, and they came from the 11 largest vaults the attacker drained. The move is the latest sign that the theft campaign is still active, even as victims and exchanges scramble to respond.
The third wave
Galaxy Research's report details how the attacker targeted Coldcard wallets, a popular hardware wallet brand. The third wave of thefts hit the 11 largest vaults, and the attacker managed to drain them completely. That's a significant chunk of the total stolen in this wave, and it suggests the attacker had deep access to the affected systems.
The $7.7 million moved this week is just part of the broader haul. Galaxy Research didn't specify the total amount stolen across all three waves, but the 45% figure for the third wave alone points to a substantial loss. The report doesn't name the exchange or service that hosted these vaults, so it's unclear how the attacker gained access.
Where the money went
The attacker consolidated the funds and moved them, though Galaxy Research didn't say where they ended up. The movement of the bitcoin is notable because it breaks the pattern of the earlier waves, where funds sat idle for weeks. This time, the attacker acted quickly, which could complicate recovery efforts.
For the victims, the timing isn't great. The third wave hit after two earlier rounds of thefts, and the fact that the attacker is still able to move funds suggests the underlying vulnerability hasn't been fully patched. Galaxy Research's report doesn't offer a timeline for when the thefts occurred, only that the third wave is the most recent.
What Galaxy Research is saying
Galaxy Research's findings are the only source of information here. The firm tracked the on-chain movements and tied them to the Coldcard thefts, but it didn't name the attacker or the affected platform. That leaves a lot of open questions: how the vaults were compromised, whether the attacker had inside help, and what the exchange is doing to prevent a fourth wave.
The report also doesn't say whether law enforcement has been notified or if any recovery efforts are underway. For now, the $7.7 million is gone, and the attacker remains unidentified.
The key question is whether the attacker will move more funds. Galaxy Research's report covers the third wave, but it doesn't say if the attacker still controls other bitcoin from earlier waves. If the pattern holds, the next move could come without warning.
For now, the affected exchange and its users are left waiting. The report doesn't mention any freeze requests or court orders, so the funds may already be beyond reach. The next concrete development will likely be another on-chain move, and Galaxy Research will be watching.
