Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says

1. #0109.07
   Initial2026-09-07 07:30 · publication time

   Coldcard exploiter moves 45% of funds stolen from ‘Wave 3’ attacks, Galaxy says

   The Coldcard exploiter has moved 45% of the funds stolen from 'Wave 3' attacks, totaling roughly 1,779 BTC from 190 victims.

   Source evidence: The Block · CoinDesk

2. #0209.07
   Escalation2026-09-07 09:36 · publication time

   Coldcard third-wave attacker moves 45% of stolen Bitcoin

   Attacker moved funds via THORChain and CoinJoin; across all waves, 82% of stolen Bitcoin remains in original addresses; created 293 multisig vaults and moved funds from the 11 largest; identified a previously unknown vault likely holding another victim's funds.

   State after update: The Coldcard Wave 3 exploiter has moved ~45% of stolen Bitcoin via THORChain and CoinJoin; across all waves, 82% of stolen funds remain in original addresses and 18% have been moved for laundering; the operation is ongoing and may have uncovered an additional victim.

   Source evidence: Cointelegraph

3. #0309.22
   Aftermath2026-09-22 06:27 · publication time

   Whitehats move 52 bitcoin from the Coldcard hack to a recovery trust

   Whitehats moved 52.37 BTC from the Coldcard hack to a newly formed recovery trust; roughly 40% of Wave 2 funds identified as whitehat activity; victims can check cryptorecoverytrust.com to see if funds were recovered; an additional 3.0134 BTC with no prior tracking history flowed to the same address.

   State after update: The Coldcard hack aftermath now includes whitehat recovery efforts: 52.37 BTC has been moved to a recovery trust address, and victims can check via a designated website; the attacker's laundering activity continues, but some funds have been intercepted by whitehats and entered a recovery process.

   Source evidence: CoinDesk · Cointelegraph

All events · Back to the feed