The attacker from the third wave of Coldcard exploits has begun cashing out, moving approximately 97.09 BTC, valued at $7.8 million, through cross-chain swaps and mixing services. Galaxy Research reported the movement on September 7, noting that this amount represents about 45% of the funds stolen during Wave 3.
The laundering process started on September 2 via THORChain, where assets were swapped for Ether. Between September 5 and 6, the perpetrator used CoinJoin transactions to further obscure the trail. The attacker is prioritizing the largest vaults first, indicating a planned approach to liquidation.
The vulnerability was caused by a firmware update from Coinkite in March 2021 (version 4.0.1 and later), which affected primarily Mk3 and newer models. A bug caused devices to use a software-based pseudo-random number generator instead of the hardware one, resulting in seeds with only 40 to 72 bits of entropy, compared to the standard 128 to 256 bits.
Coinkite has since patched the firmware, but seeds generated during the vulnerable period remain compromised. The company has advised users to generate new seeds and migrate their funds. Galaxy Research, led by Alex Thorn, has been tracking the exploit chain since July 30, 2026.
Total confirmed losses are approximately 1,789 BTC, valued at $114.7 million at the time of theft. More than 8,865 addresses were affected, with the median victim losing over 1 BTC. An additional cluster of 58 addresses could increase total losses to roughly 1,806 BTC.
The attacks occurred in waves from July 30 to August 6, involving at least 15 different attackers. The first wave alone extracted 1,082.65 BTC in 41 minutes. Currently, 82% of the stolen Bitcoin remains in attacker-controlled wallets, while only 18% has been laundered. Galaxy Research has contacted over 190 victims and shared data with law enforcement.
