Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul
The Coldcard “wave 3” exploiter has moved 97.09 BTC, about 45% of that wave’s haul and roughly $7.7 million. About 20.5 BTC was first bridged through THORChain to Ethereum on September 2, while the latest transfers were pushed through CoinJoin rounds; only 20.56 BTC has actually reached Ethereum. Another 57.24 BTC remains as CoinJoin change, and Galaxy says the trail ends on about 19 BTC more. Galaxy says the attacker created 293 two-of-two multisig vaults and is draining them from largest to smallest. Eleven are empty, and most of the remaining coins are still parked. The thefts stem from a March 2021 Coldcard firmware bug that weakened seed entropy and allowed offline key recovery. Coinkite has since fixed the firmware, but affected wallets must be reseeded and moved to new addresses. Galaxy also flagged a new suspected victim vault, which could raise total losses from the exploit to about 1,806 BTC.
