The operator linked to Wave 3 of the Coldcard Bitcoin thefts has moved about 45% of the Bitcoin in the victim vault cluster, according to Galaxy Research. The stolen coins were moved through THORChain and CoinJoin transactions, two different methods that can make tracking fund movements more difficult. Galaxy said the operator is emptying the vaults from the largest to the smallest. As the investigation into the Coldcard thefts continues, the most recent activity was noted on September 7, 2026.
The most recent changes were revealed in an on-chain update published on September 7 by Galaxy Research, the research division of Galaxy Digital. Bitcoin block 965,863 was used as the timestamp for the change.
Coldcard ‘Wave 3’ exploiter continues to move funds
In wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim’s coins.
The first movements on 9/2 sent coins over THORChain to Ethereum.
Tonight’s movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah
— Galaxy Research (@glxyresearch) September 7, 2026
The activity marks a change in the hacker’s approach. The first confirmed cash-out from the Wave 3 cluster took place on September 2, when 20.50 BTC was sent through THORChain and converted into ether. The September 5 and September 6 movements, however, used CoinJoin rounds instead.
Galaxy said the Wave 3 operator originally created 293 separate 2-of-2 multisignature vaults. These vaults held Bitcoin belonging to different victim groups. Twelve vaults have already been used, transferring a total of 97.09 BTC, according to the company’s monitoring. There are still 282 vaults with 116.98 BTC in them.
The first vault to be emptied was the biggest. It sent 20.50 BTC to two Ethereum addresses using THORChain on September 2. Galaxy said the funds subsequently held in those addresses were emptied.
The second-largest vault moved 15.48 BTC on September 5. The Bitcoin first went to a Taproot address and entered a CoinJoin round about 84 minutes later.
A much larger movement followed on September 6. Vaults ranked third through eleventh, along with another vault Galaxy believes may be connected to the same attack, moved 61.12 BTC to a Taproot address. The funds then entered a CoinJoin about 56 minutes later.
Galaxy has also identified a separate 6.34 BTC vault that could be connected to another Coldcard victim group. If included, the Wave 3 cluster would contain 294 vaults, and Galaxy’s estimated total Coldcard losses would rise to around 1,806 BTC.
The 45% figure should not be confused with the entire Coldcard theft. About 18% of the coins that Galaxy ties to the broader issue have been transferred in ways that it believes are compatible with money laundering, while about 82% of the coins are still in the original attacker-controlled addresses. The Wave 3 vault cluster is directly related to the 45% figure.
Since Galaxy initially discovered Wave 3 on August 1, the theft has expanded significantly. In later revisions, their estimations have increased from around 1,367 BTC to approximately 1,789 BTC.
A firmware flaw that compromised seed generation on impacted Coldcard devices was the fundamental security flaw. Coinkite, the manufacturer, said the devices were not remotely hacked. Instead, attackers could potentially regenerate private keys offline from vulnerable seeds. Users with affected seeds have been advised to create new seeds using fixed firmware and move their funds.
Galaxy continues to trace the stolen Bitcoin and said it is sharing its findings with victims, industry participants and law-enforcement agencies.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment