The attacker linked to the third wave of Coldcard-related thefts has moved 97.09 BTC, or about 45% of the bitcoin stolen in that batch, according to Galaxy Research. At current prices cited in the report, that portion is worth roughly $7.8 million.
Galaxy said the funds were laundered through a combination of THORChain swaps and CoinJoin transactions. Even so, most of the broader haul has not yet left the addresses that first received the stolen bitcoin.
Largest wallets were drained first
Galaxy Research said 97.09 BTC has been moved so far, beginning with the wallets that held the biggest balances. The firm said funds from the 11 largest wallets tied to the third attack have already been transferred.
Among the wallets that have not yet been touched, the next 10 hold a combined 30.81 BTC. Another 233 smaller wallets contain 33.77 BTC in total, showing that the remaining stolen assets are spread across a large number of addresses.
Most stolen funds remain in place
Despite the recent activity, Galaxy said about 82% of the stolen assets still sit at the original recipient addresses. The remainder has been sent onward to other addresses as part of the laundering process.
That split suggests the attacker has only partially processed the proceeds from the third theft wave so far, with a large share still visible on-chain at the first destination wallets.
Attack traced to a 2021 firmware flaw
The thefts stem from a Coldcard firmware flaw dating back to 2021 that weakened randomness during seed generation, according to Galaxy Research. The weakness allegedly allowed the attacker to brute-force private seed phrases and empty affected single-signature wallets without directly accessing the hardware devices themselves.
In practical terms, the issue meant compromised seeds could be reconstructed, letting the attacker take funds from wallets created under the vulnerable conditions.
Estimated losses rise above 1,800 BTC
Galaxy Research estimated that by mid-August, about 1,779 BTC had been stolen from roughly 190 victims and more than 8,600 addresses. The firm said that figure has increased after identifying additional related addresses.
Including those previously unidentified addresses, Galaxy now puts cumulative losses at 1,806 BTC. Based on current prices cited in the report, that total is worth about $143.9 million.
The next confirmed point to watch is whether more of the untouched wallets from the third attack begin to move. For now, Galaxy’s on-chain findings indicate that the majority of the stolen bitcoin remains where it first landed, while a smaller portion has already been routed through THORChain and CoinJoin.
Source: en.bloomingbit.io