A hacker behind the third wave of Coldcard-related thefts moves about $7.7 million worth of Bitcoin, according to crypto analytics cited by multiple outlets. CoinDesk reports the attacker drains the 11 largest vaults associated with the third attack wave, while Cointelegraph describes that the move involves a large share of the Bitcoin taken.
Cointelegraph, citing Galaxy Research, says 45% of the stolen Bitcoin is moved, while 55% remains in the original addresses. Galaxy also reports that across all Coldcard attacks, about 82% of the Bitcoin stolen stays in the original addresses and 18% is moved in what appears to be laundering activity. CoinDesk focuses more on the extent of the outflows from the largest vaults tied to the third wave.
Together, the reports indicate the theft campaign involves multiple waves, with investigators tracking how funds are handled over time—either left in initial wallet addresses or transferred as part of laundering.
