Coldcard Wave 3 Attacker Moves 45% of Stolen Bitcoin — $7.7 Million in BTC Now in Motion

Summary

The attacker linked to the third wave of Coldcard hardware wallet thefts has now moved approximately 45% of the stolen Bitcoin — roughly $7.7 million — after a period of dormancy. This follows the September 3 THORChain test swap (approximately 10% of funds) covered in TTO-2026-0905-101. The accelerated movement suggests the attacker has moved from route-testing to active fund dispersal. Approximately 55% of Wave 3 funds remain in the original attacker-controlled addresses.

Timeline

What Happened

The Wave 3 exploit, tied by Galaxy Research to the theft of at least 1,789 Bitcoin across 8,865 addresses, has now entered an active dispersal phase. The $7.7 million moved represents approximately 45% of the Wave 3 total — a significant shift from the roughly 10% moved in the first confirmed on-chain transaction three days earlier.

Routing native Bitcoin into other assets via THORChain disrupts the transaction graph that blockchain forensics tools rely on to flag stolen funds. Law enforcement and crypto companies tracking the initial Ethereum address are now monitoring an expanding set of destination addresses. Coinkite has said affected seeds require migration to new wallets regardless of firmware updates, as a compromised wallet credential cannot be repaired by installing new firmware on the same device.

Domain Intelligence

coldcard.com — 62.0

Score unchanged from prior coverage. Coinkite's coldcard.com has an existing score trajectory on record with this outlet. See TTO-2026-0821-006 and TTO-2026-0905-101 for prior coverage of the Coldcard incident and score history.