A Coldcard exploiter has moved nearly half of the bitcoin stolen in a series of attacks dubbed 'Wave 3,' according to a report from Galaxy. As of mid-August, roughly 1,779 BTC had been taken from 190 victims, spread across more than 8,600 addresses.
Where the funds went
Galaxy's analysis shows that 45% of the stolen funds have now been transferred, though the report doesn't specify the exact destination. The movement suggests the attacker is actively consolidating or laundering the haul, a common step after a large-scale theft.
The remaining 55% still sits in the original addresses, which could mean the exploiter is waiting for the heat to die down or planning a more careful exit. Either way, the clock is ticking for anyone hoping to recover the funds.
Who was hit
The 190 victims range from individual holders to smaller operations, all of whom used Coldcard hardware wallets. The attacks targeted a specific vulnerability in the device's firmware, though the exact method hasn't been fully disclosed. Galaxy's report doesn't name the victims, but the scale suggests a coordinated campaign rather than random hits.
Each victim lost an average of about 9.36 BTC, a significant sum for most users. The thefts happened over a period of time, with the 'Wave 3' label pointing to a third round of attacks in an ongoing pattern.
What's being done
Galaxy has been tracking the stolen funds and publishing updates to help exchanges and law enforcement flag the addresses. The movement of 45% of the haul is a red flag that the attacker is becoming more active, which could make recovery harder.
Coldcard has not issued a public statement about the specific vulnerability, but users are advised to update their firmware and move funds to a new wallet if they suspect exposure. The company's support channels have been fielding questions from affected users, though details remain scarce.
For now, the focus is on tracing the 1,779 BTC and hoping the attacker makes a mistake. The next few weeks will be critical, as the remaining funds could move at any time.
