Coldcard exploiter moves 45% of funds stolen from 'Wave 3' attacks, Galaxy says

The attacker behind the exploits on Coldcard bitcoin hardware wallets has moved 45% of stolen assets from the third wave of attacks, Galaxy Research said.

According to the firm's posts on social media platform X, Galaxy said the Wave 3 operator continues to move stolen bitcoin (BTC). While the exploiter previously swapped the coins to ether (ETH) via THORChain on Sept. 2, they ran the stolen bitcoin through CoinJoin transactions on Sunday. A total of 97.09 BTC ($7.8 million at Monday's prices) has been spent so far.

The attacker has been moving the stolen coins in size order, largest first. Galaxy said ranks 1-11 are already moved, while the next 10 untouched vaults hold 30.81 BTC, and the smaller vaults (ranks 61-293) hold 33.77 BTC combined.

In terms of total funds exploited out of Coldcard devices, 82% remains in the original attacker-controlled addresses, while the rest has been moved for laundering purposes, Galaxy added.

The thefts, which started on July 30, stemmed from a firmware bug that Coinkite shipped back in 2021. This affected how Coldcard devices generated wallet seeds, reducing the randomness used to create them and allowing attackers to brute-force the private seed phrases and drain single-signature addresses without touching the device.

By mid-August, Galaxy said it had identified roughly 1,779 BTC stolen from 190 victims and more than 8,600 addresses. The research firm mentioned the possibility of there being a Wave 4, but has not confirmed yet.

In Monday's post, Galaxy noted that the exploiter "co-spent" a previously unknown vault consisting of 58 addresses that are likely Coldcard victims. Counting this would bring the total losses to 1,806 BTC, which is $143.9 million at current prices.