The attacker responsible for the third wave of Coldcard hardware wallet breaches has initiated significant movement of stolen assets, transferring approximately $7.7 million in Bitcoin that represents 45% of the cryptocurrency taken during that specific campaign.
According to Galaxy Research, the exploiter has systematically drained the 11 largest vaults tied to the third wave of thefts, following a deliberate pattern of emptying them in order of size, largest first. The attacker constructed an elaborate storage architecture comprising 293 separate vaults to hold the stolen Bitcoin, suggesting a sophisticated approach to managing the illicit proceeds across multiple segregated containers.
The recent transfers mark the most substantial liquidation activity observed from this particular phase of the prolonged Coldcard security incident. The third wave represents one segment of a broader exploitation campaign that has affected numerous cryptocurrency holders using the specialized hardware wallets. As of mid-August, Galaxy had identified approximately 1,779 BTC stolen from 190 victims across more than 8,600 addresses, illustrating the extensive scope of the compromise.
Despite the recent movement of funds from the third wave, the majority of stolen assets across all Coldcard-related attacks remain stationary. Galaxy's analysis indicates that 82% of Bitcoin stolen across all attack waves remains in the original addresses, with only 18% having been moved in apparent laundering attempts. This suggests that while the third wave attacker has become active, most victims' funds have not yet entered the liquidation pipeline.
The methodical nature of the current transfers—specifically targeting the largest repositories first—indicates a calculated extraction strategy rather than opportunistic movement. By prioritizing the 11 biggest vaults, the attacker maximizes liquidity efficiency while potentially leaving smaller holdings for later stages of the operation or alternative distribution methods.
The compartmentalization into 293 distinct vaults represents a significant operational effort to fragment the stolen assets, potentially complicating tracking efforts or enabling staged liquidation to avoid market disruption and detection. This structural complexity distinguishes the third wave handling from more straightforward cryptocurrency thefts where funds often move immediately to exchanges or mixing services.
While the $7.7 million transfer constitutes nearly half of the third wave's specific haul, it represents a fraction of the total 1,779 BTC identified across all waves. The disparity between the 45% third-wave movement rate and the 18% overall movement rate suggests that different attack phases may follow distinct timelines, or that the third wave specifically has entered an active liquidation phase while other stolen funds remain in storage. Security analysts continue monitoring the remaining vaults for additional movement, as the dormant majority of funds across all Coldcard attacks presents an ongoing risk of future liquidation.