{ "version": 1, "event_id": "evt_65f972f6d8c15c28", "url": "https://xiyu.news/events/evt_65f972f6d8c15c28/", "json": "https://xiyu.news/api/events/evt_65f972f6d8c15c28.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "Coldcard 第三波被盗资金约45%已转移，比例不代表全部损失", "en": "Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says" }, "current_state": { "zh": "Coldcard黑客事件后续出现白帽恢复行动：52.37枚比特币已被转移至恢复信托地址，受害者可通过指定网站查询；攻击者的洗钱活动仍在进行，但部分资金已被白帽拦截并进入恢复流程。", "en": "The Coldcard hack aftermath now includes whitehat recovery efforts: 52.37 BTC has been moved to a recovery trust address, and victims can check via a designated website; the attacker's laundering activity continues, but some funds have been intercepted by whitehats and entered a recovery process." }, "first_seen_at": "2026-09-07T09:34:03.581519+00:00", "last_updated_at": "2026-09-22T09:25:32.635486+00:00", "last_material_change_at": "2026-09-22T09:25:24.409987+00:00", "confidence": 0.75, "updates_count": 3, "sources_count": 5, "entities": [ "coldcard", "galaxy", "wave", "whitehats" ], "identifiers": [], "topics": [ "coldcard", "galaxy", "galaxy-research", "laundering", "theft" ], "updates": [ { "update_id": "upd_cea4abd91245eb8d", "event_id": "evt_65f972f6d8c15c28", "occurred_at": "2026-09-07T07:30:32Z", "published_at": "2026-09-07T07:30:32Z", "first_seen_at": "2026-09-07T09:34:03.581519Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "Coldcard 第三波被盗资金约45%已转移，比例不代表全部损失", "title_en": "Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says", "what_changed_zh": "据 The Block 9月7日援引 Galaxy Research 的追踪，Coldcard 第三波攻击者已转移该波被盗资金的约45%。这个比例仅针对第三波资金，不是全部被盗比特币的45%。\n\n原日报将第三波比例与历史累计损失混用，现已更正。不同波次及观察时间的数据应分别理解，不能直接合并计算。", "what_changed_en": "The Coldcard exploiter has moved 45% of the funds stolen from 'Wave 3' attacks, totaling roughly 1,779 BTC from 190 victims.", "current_state_zh": "据 The Block 9月7日援引 Galaxy Research 的追踪，Coldcard 第三波攻击者已转移该波被盗资金的约45%。这个比例仅针对第三波资金，不是全部被盗比特币的45%。\n\n原日报将第三波比例与历史累计损失混用，现已更正。不同波次及观察时间的数据应分别理解，不能直接合并计算。", "current_state_en": "The Coldcard exploiter has moved 45% of the funds stolen from 'Wave 3' attacks, totaling roughly 1,779 BTC from 190 victims.", "detailed_summary_zh": "The Coldcard exploiter has moved 45% of the funds stolen from 'Wave 3' attacks, totaling roughly 1,779 BTC from 190 victims.", "detailed_summary_en": "The Coldcard exploiter has moved 45% of the funds stolen from 'Wave 3' attacks, totaling roughly 1,779 BTC from 190 victims.", "background_zh": "Coldcard 是一款流行的比特币硬件钱包。所谓“第三波”攻击指一系列针对钱包的盗窃事件，这些钱包的助记词显然是在熵不足或可预测的情况下生成的，因此攻击者即使未接触硬件也能推导出私钥。THORChain 是一个跨链流动性协议，CoinJoin 则是一种比特币隐私技术，通过混币来切断交易链条。Galaxy Research 一直在追踪这些链上资金流动，并呼吁受影响用户上报损失。", "background_en": "Coldcard is a popular Bitcoin hardware wallet. The so-called 'Wave 3' attacks refer to a series of thefts from wallets whose seed phrases were apparently generated with insufficient or predictable entropy, so attackers could derive private keys despite the hardware being offline. THORChain is a cross-chain liquidity protocol, and CoinJoin is a Bitcoin privacy technique that mixes coins to break the transaction trail. Galaxy Research has been tracking these on-chain movements and asking affected users to report their losses.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "主要受影响的资产是比特币，但链上洗钱行为本身并不会直接改变市场供应。如果攻击者最终通过交易所出售清洗后的 BTC，可能会带来卖压；否则，其影响可能仅限于硬件钱包安全和自托管方面的负面情绪。", "market_impact_en": "The main asset exposed is Bitcoin, but the on-chain laundering itself does not directly alter market supply. Potential market impact would arise if the attacker eventually sells the cleaned BTC on exchanges, adding sell-side pressure; otherwise, the likely effect remains limited to negative sentiment around hardware-wallet security and self-custody.", "importance_score": 8.5, "references": [ { "url": "https://www.theblock.co/news/defi/2026-09-07-coldcard-exploiter-moves-wave-3-413661", "title": "Coldcard exploiter moves 45% of funds stolen from 'Wave 3 ..." }, { "url": "https://cointelegraph.com/news/coldcard-hack-galaxy-btc-lost-87-unmoved", "title": "Galaxy Finds 1,561 Bitcoin From Coldcard Hack Still Unmoved" }, { "url": "https://www.galaxy.com/insights/research/your-keys-not-your-coins-coldcard-wallets-hacked-for-130m-and-counting", "title": "Coldcard Wallets Hacked for $130m and Counting | Galaxy" } ], "confidence": 0.75, "story_ids": [ "rss:www.theblock.co_rss.xml:8d4075dd8b42c6bd", "rss:www.coindesk.com_arc_outboundfeeds_rss_:fd4b96583feeca2c", "editorial:pick:4f8fc5e553adc57b" ], "sources": [ { "url": "https://www.theblock.co/news/defi/2026-09-07-coldcard-exploiter-moves-wave-3-413661", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/business/2026/09/07/coldcard-hacker-moves-45-of-bitcoin-stolen-in-third-attack-wave", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e117025cf87297a9", "event_id": "evt_65f972f6d8c15c28", "occurred_at": "2026-09-07T09:36:19Z", "published_at": "2026-09-07T09:36:19Z", "first_seen_at": "2026-09-07T17:50:05.285366Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Coldcard 第三波攻击者转移了 45% 的被盗比特币", "title_en": "Coldcard third-wave attacker moves 45% of stolen Bitcoin", "what_changed_zh": "攻击者通过THORChain和CoinJoin转移资金；所有波次中82%的被盗比特币仍留在原始地址；创建了293个多签金库，并已转移其中11个最大金库的资金；发现了一个可能属于另一受害者的未知金库。", "what_changed_en": "Attacker moved funds via THORChain and CoinJoin; across all waves, 82% of stolen Bitcoin remains in original addresses; created 293 multisig vaults and moved funds from the 11 largest; identified a previously unknown vault likely holding another victim's funds.", "current_state_zh": "Coldcard Wave 3攻击者已转移约45%的被盗比特币，采用THORChain和CoinJoin混币方式；所有波次中82%的被盗资金仍在原始地址，18%已转移用于洗钱；攻击操作仍在进行中，且可能发现新的受害者。", "current_state_en": "The Coldcard Wave 3 exploiter has moved ~45% of stolen Bitcoin via THORChain and CoinJoin; across all waves, 82% of stolen funds remain in original addresses and 18% have been moved for laundering; the operation is ongoing and may have uncovered an additional victim.", "detailed_summary_zh": "The Coldcard third-wave attacker has moved 45% of stolen Bitcoin via THORChain and CoinJoin, with 82% of all stolen funds still in original addresses.", "detailed_summary_en": "The Coldcard third-wave attacker has moved 45% of stolen Bitcoin via THORChain and CoinJoin, with 82% of all stolen funds still in original addresses.", "background_zh": "Coldcard 是一种比特币硬件钱包，通过离线保存私钥来保护资产，而攻击者利用其密钥生成过程中的漏洞掏空了用户钱包。THORChain 是一个去中心化交易所，允许用户无需 KYC 或包装代币即可跨链兑换原生比特币；CoinJoin 则是一种比特币隐私技术，将多个用户的付款合并到一笔交易中以混淆资金去向。Galaxy Research 通过链上追踪这些转账，估算已被洗钱以及仍由攻击者控制的资金比例。", "background_en": "Coldcard is a Bitcoin hardware wallet that keeps private keys offline, and attackers have exploited flaws in its key-generation process to drain wallets. THORChain is a decentralized exchange that lets users swap native Bitcoin across blockchains without KYC or wrapped tokens, while CoinJoin is a Bitcoin privacy technique that combines multiple users' payments into one transaction to obscure the trail. Galaxy Research tracked these movements on-chain to estimate how much of the stolen funds has been laundered and how much remains under attacker control.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "被盗 BTC 经 THORChain 和 CoinJoin 转移，增加了部分资金最终流入交易所的可能性，可能影响比特币的流动性和市场情绪；同时，备受关注的 Coldcard 事件也可能削弱用户对硬件钱包产品的信心。这些转账本身不算直接市场交易，不应被视为价格方向性信号。", "market_impact_en": "Movement of stolen BTC through THORChain and CoinJoin raises the likelihood that some funds eventually reach exchanges, which could affect Bitcoin liquidity and sentiment; at the same time, high-profile Coldcard incidents may shake confidence in hardware-wallet products. The transfers themselves do not constitute a direct market trade and should not be read as a directional signal.", "importance_score": 7.5, "references": [ { "url": "https://thorchain.org/", "title": "Crypto DEX | Swap BTC, ETH, & XMR | No KYC | THORChain" }, { "url": "https://moneroswapper.io/blog/monero-vs-coinjoin-privacy-comparison-hi", "title": "Monero vs CoinJoin: अंतर्निहित प्राइवेसी vs बिटकॉइन... | MoneroSwapper" }, { "url": "https://pluang.com/en/news-feed/kerentanan-dompet-hardware-coldcard-bobol-rp38-miliar-bitcoin", "title": "$38M stolen from Coldcard bitcoin wallets due t... | Pluang" } ], "confidence": 0.9, "story_ids": [ "rss:cointelegraph.com_rss:c79508931f63a9c3" ], "sources": [ { "url": "https://cointelegraph.com/news/coldcard-third-wave-attacker-moves-bitcoin-stolen?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c50b1057bf4ad1c5", "event_id": "evt_65f972f6d8c15c28", "occurred_at": "2026-09-22T06:27:28Z", "published_at": "2026-09-22T06:27:28Z", "first_seen_at": "2026-09-22T09:25:24.409987Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "白帽黑客将 Coldcard 攻击事件中的 52 枚比特币转入恢复信托", "title_en": "Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust", "what_changed_zh": "白帽黑客将52.37枚比特币从Coldcard黑客事件中转移至新成立的恢复信托地址；约40%的Wave 2资金被确认为白帽活动；受害者可在cryptorecoverytrust.com查询资金是否被追回；另有3.0134枚比特币无先前追踪记录流入该地址。", "what_changed_en": "Whitehats moved 52.37 BTC from the Coldcard hack to a newly formed recovery trust; roughly 40% of Wave 2 funds identified as whitehat activity; victims can check cryptorecoverytrust.com to see if funds were recovered; an additional 3.0134 BTC with no prior tracking history flowed to the same address.", "current_state_zh": "Coldcard黑客事件后续出现白帽恢复行动：52.37枚比特币已被转移至恢复信托地址，受害者可通过指定网站查询；攻击者的洗钱活动仍在进行，但部分资金已被白帽拦截并进入恢复流程。", "current_state_en": "The Coldcard hack aftermath now includes whitehat recovery efforts: 52.37 BTC has been moved to a recovery trust address, and victims can check via a designated website; the attacker's laundering activity continues, but some funds have been intercepted by whitehats and entered a recovery process.", "detailed_summary_zh": "Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust", "detailed_summary_en": "Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.7, "references": [], "confidence": 0.9, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:991bc8d2b89a5074", "rss:cointelegraph.com_rss:c97c57e67eb01357" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/22/whitehats-move-52-bitcoin-from-the-coldcard-hack-to-a-recovery-trust", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/white-hats-coldcard-btc-exploit-galaxy?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] } ] }