Galaxy Research: Coldcard "Wave 3" attackers have moved 45% of stolen funds; total losses may reach 1,806 BTC
AI Market Summary
Galaxy Research reports Coldcard "Wave 3" attackers have moved ~45% of stolen BTC, using THORChain to bridge to Ethereum and then CoinJoin mixers, indicating ongoing laundering and reduced recovery odds. Remaining vault balances suggest additional transfers are likely. The episode reinforces counterparty and wallet-supply-chain risk, potentially pressuring near-term sentiment and prompting heightened scrutiny of cross-chain bridges and mixing activity.
Impact level
● Medium
Affected assets
BTC/USDT-0.16%
AI Insight · BTC/USDTAI Insight
▼ Bearish
Trade now
⚠️ AI-generated insights are based on news content and are provided for informational purposes only. They do not constitute investment advice or represent the views of BingX. Investing involves risk. Please trade responsibly.
PANews, Sept. 7 — Galaxy Research said in its latest tracking update that the group behind the Coldcard "Wave 3" incident continues to move stolen funds. Investigators found the attackers previously set up 293 2-of-2 multisignature vaults, one for each victim. The funds were first bridged to Ethereum via THORChain on Sept. 2 and have recently been routed through CoinJoin mixers.
So far, vaults ranked 1–11 by size have been processed. The next 10 unprocessed vaults still hold 30.81 BTC, while vaults ranked 61–293 collectively retain 33.77 BTC. Galaxy Research estimates about 45% of the total stolen coins have now been moved, with total theft from the incident potentially reaching 1,806 BTC.
