Home›Crypto›Market Structure›Coldcard exploiter moves 45% of Wave 3 stolen bitcoin,…

Coldcard exploiter moves 45% of Wave 3 stolen bitcoin, Galaxy says

Galaxy Research said the Wave 3 attacker has spent 97.1 BTC so far and identified about 1,806 BTC in potential total losses if an additional 58-address vault is counted.

Reported · Written up by our desk · Market Structure

The Block reports that Galaxy Research says the operator behind Coldcard hardware wallet exploits has moved 45% of the bitcoin stolen in the so-called Wave 3 attacks.

By mid-August, Galaxy said it identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses. The firm also said the exploiter has continued to move the stolen BTC, including swapping coins to ether (ETH) via THORChain on Sept. 2 and later running the stolen bitcoin through CoinJoin transactions on Sunday.

Galaxy said a total of 97.09 BTC, worth $7.8 million at Monday prices, has been spent so far. It added that the attacker has been moving funds in size order, with ranks 1 to 11 already moved, the next 10 untouched vaults holding 30.81 BTC, and smaller vaults, ranks 61 to 293, holding 33.77 BTC combined.

The research firm said 82% of the exploited funds remains in the original attacker-controlled addresses, while the rest has been moved for laundering. Galaxy traced the thefts, which began July 30, to a Coldcard firmware bug Coinkite shipped in 2021, and it noted the possibility of a Wave 4, though it has not confirmed it. In a separate note, Galaxy said the exploiter co-spent a previously unknown vault of 58 addresses, which it said could raise total losses to 1,806 BTC, or $143.9 million at current prices.

Latest closeBitcoin $79,153.04 ▼1.5%|Ethereum $2,494.50 ▼0.8%

More like this

Sources