The attacker behind a series of exploits targeting Coldcard hardware wallets continues to move stolen bitcoin. According to Galaxy Research, the operator responsible for the third wave of attacks has already moved around 45% of the funds stolen during that phase.
Researchers estimate that approximately 97.09 BTC, worth about $7.8 million, has recently been transferred. Some of the transactions involved CoinJoin, a technique designed to make blockchain fund flows more difficult to trace.
At the same time, most of the stolen assets remain untouched. Galaxy estimates that around 82% of all stolen BTC is still sitting at the original addresses linked to the attacker.
The Attacker Is Gradually Moving the Largest Balances
Transaction analysis suggests that the attacker is not moving all of the stolen funds at once, but is instead working through compromised wallets sequentially, starting with the largest balances.
According to Galaxy, funds from the 11 largest wallets have already been moved. The next 10 untouched wallets reportedly hold a combined total of around 30.81 BTC.
Another group of smaller wallets, ranked between 61st and 293rd by balance size, contains approximately 33.77 BTC in total.
This pattern may indicate that the attacker is attempting to gradually consolidate or obscure the origin of the stolen funds while avoiding a single large transfer of the entire amount.
Part of the BTC Was Routed Through CoinJoin
The attacker had previously moved some of the stolen assets through various crypto services. In particular, part of the BTC was exchanged for Ether through THORChain.
Later, the attacker began using CoinJoin, a transaction-mixing mechanism that combines multiple transfers and makes it more difficult to determine the original source and final destination of individual coins.
Galaxy estimates that around 18% of all stolen funds have already left the original addresses through transactions that researchers associate with attempts to make further tracking more difficult.
The Attacks Were Linked to a Coldcard Seed Generation Vulnerability
The series of thefts began on July 30. Researchers linked the incident to a flaw in the firmware of certain Coldcard devices that had been introduced as early as 2021.
The issue affected the process used to generate seed phrases on some devices. Due to insufficient randomness, certain combinations could be significantly more predictable than intended by the security design.
This potentially allowed attackers to reconstruct the information needed to gain access to vulnerable Bitcoin wallets without obtaining physical access to the hardware device itself.
The incident highlights that hardware wallet security depends not only on keeping private keys offline, but also on the reliability of the algorithms used to generate cryptographic data in the first place.
Galaxy Previously Identified Around 1,779 BTC as Stolen
By mid-August, Galaxy Research estimated that approximately 1,779 BTC had been stolen.
According to the firm, the attacks may have affected around 190 users and more than 8,600 Bitcoin addresses.
Researchers also raised the possibility of an additional wave of attacks, although that scenario had not been conclusively confirmed at the time.
A Newly Identified Address Cluster Could Raise Losses to 1,806 BTC
During subsequent analysis, Galaxy discovered a previously unidentified group of 58 addresses whose funds were later spent together by the attacker.
Researchers believe these addresses may have belonged to additional victims of the same Coldcard exploit.
If that assumption is confirmed, the total amount stolen could rise to approximately 1,806 BTC. At current estimated bitcoin prices, that would equal roughly $143.9 million.
Galaxy emphasized, however, that the revised figure remains an estimate. Researchers have not yet confirmed that every newly identified address was compromised specifically through the Coldcard vulnerability.
Most of the Stolen Bitcoin Remains at the Original Addresses
Despite the ongoing movement of funds, a significant portion of the stolen assets has still not been transferred.
Galaxy estimates that around 82% of the stolen BTC remains at the attacker’s original addresses. This means future activity from those wallets could provide analysts with additional information about the attacker’s strategy and potential laundering routes.
The Coldcard incident has already become one of the largest recent attacks involving Bitcoin hardware wallets. If the estimate of 1,806 BTC is confirmed, total losses could approach $143.9 million, while the investigation may continue to expand as new related addresses and transactions are identified.