TL;DR
- Coldcard Movements: Attacker shifted 97.09 BTC ($7.7 million), routing funds through THORChain and CoinJoin while working through the largest vaults.
- Coldcard Vault Structure: Galaxy said the exploiter created 293 multisignature vaults and likely added a previously unknown one, raising Wave 3 to 294 vaults and expanding the Coldcard theft’s scale.
- Coldcard Exploit Impact: About 82% of stolen Bitcoin remains in attacker-controlled addresses, while 18% has moved. The wallet flaw stemmed from weak randomness in wallet seed generation.
The third wave of the Coldcard theft continues to unfold as Galaxy Research tracks fresh movements from the exploiter who has begun shifting significant portions of stolen Bitcoin. The latest activity shows the attacker moving 97.09 BTC, worth $7.7 million, through THORChain and CoinJoin transactions, marking a major step in the laundering process. Coldcard remains central to the investigation, with researchers uncovering new vaults and tracing patterns that reveal how the attacker structured the operation.
Coldcard ‘Wave 3’ exploiter continues to move funds
In wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim’s coins.
The first movements on 9/2 sent coins over THORChain to Ethereum.
Tonight’s movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah
— Galaxy Research (@glxyresearch) September 7, 2026
Movement Through THORChain and CoinJoin
Galaxy said the exploiter started routing funds on Sept. 2, sending 20.5 BTC from the largest vault through THORChain, with proceeds landing on Ethereum. Days later, the attacker shifted 15.48 BTC from the second-largest vault into a CoinJoin transaction, followed by another 61.12 BTC from 10 vaults. CoinJoin mixes payments from multiple users, making it harder to link inputs and outputs, and Galaxy believes these steps were taken to obscure the trail.
Both texts confirm the attacker created 293 two-of-two multisignature vaults to hold victims’ coins. The exploiter has now emptied the 11 largest vaults, and the next 10 contain 30.81 BTC. Vaults ranked 61 through 293 hold a combined 33.77 BTC. Galaxy also identified a previously unknown vault funded by 58 addresses, likely tied to another Coldcard victim, though its origin remains unconfirmed.
Scale of the Exploit and Ongoing Impact
Including the newly identified vault, Wave 3 may rise to 294 vaults and push the wider Coldcard exploit to about 1,806 BTC, valued near $143.9 million. Galaxy said about 82% of stolen Bitcoin across all waves remains in attacker-controlled addresses, while 18% has moved in transactions that appear designed to hide the funds’ path.
The thefts began July 30 after attackers exploited a firmware flaw that weakened randomness used by Coldcard devices to generate wallet seeds. Coinkite has released fixed firmware, but affected users must create new seeds and move their funds because an update cannot repair compromised ones. Coldcard remains at the center of one of 2026’s largest crypto security incidents.
