A third-wave attacker has moved 45% of the Bitcoin they stole in Coldcard attacks, according to data from Galaxy. The firm's broader tally shows 82% of all Bitcoin taken in Coldcard attacks still sits in the original addresses — only 18% has been moved in what looks like laundering.
The third wave stands out
That 45% figure puts this attacker well above the average. Across every Coldcard attack Galaxy tracked, most thieves haven't touched their haul. This one has. Nearly half of what they took is now somewhere else.
The gap between the third-wave attacker and the rest is stark. While the overall moving rate sits at 18%, this single actor has shifted more than double that share. That suggests a deliberate effort to clean the funds, not a casual transfer.
Most of the haul hasn't budged
Galaxy's numbers make one thing clear: the bulk of the stolen Bitcoin is still sitting in the original addresses. 82% hasn't moved at all. That's a lot of money parked where it was first sent.
Why so little movement? The data doesn't say. It could be patience, caution, or an inability to launder without getting caught. But the practical effect is the same — most of the stolen coins are traceable, sitting in wallets that investigators already know about.
What the laundering looks like
The 18% that has moved shows signs of apparent laundering, Galaxy reported. The third-wave attacker's 45% is part of that picture, but it's the outlier. Most attackers who moved funds did so in smaller chunks.
That makes the third-wave attacker the one to watch. They're moving more, faster, and in a way that diverges from the pattern of everyone else. Whether that's confidence, desperation, or a better laundering setup isn't clear from the data alone.
What is clear: the window for tracking these coins is closing. Every transfer adds distance from the original theft, and the third-wave attacker is adding a lot of it.
