Galaxy Research said attackers tied to the “third wave” of the Coldcard hardware wallet theft are still moving stolen funds, with about 45% of the coins in that cluster already transferred out and additional newly identified addresses potentially lifting the estimated total theft to about 1,806 BTC.

According to Galaxy Research, the attackers created 293 separate 2-of-2 multi-signature vaults for victims in the third wave. The firm said the first batch of funds was transferred to Ethereum through THORChain on September 2 and has since entered the mixing process.

Galaxy said the attackers appear to be processing funds based on the amount stolen from each victim. It reported that the top 11 vaults have already been transferred. By contrast, the last 10 untouched vaults still hold a combined 30.81 BTC, while vaults ranked from 61 to 293 hold another 33.77 BTC.

Based on that tracking, Galaxy estimated that about 45% of the stolen coins from the third wave have been moved. It also said roughly 82% of the stolen BTC overall remains in addresses controlled by the attackers, while about 18% has been transferred.

The report also identified 58 new addresses that spend in the same 2-of-2 multi-signature format. Galaxy said those addresses may also belong to Coldcard victims, which would raise the estimated total amount stolen to about 1,806 BTC. Details on the affected users and any potential recovery effort were not disclosed in the update.

Why It Matters

This update extends the Coldcard theft from a static loss event into an active laundering story. Once stolen BTC moves through cross-chain infrastructure and mixers, the practical challenge for investigators, exchanges, and compliance teams becomes much harder, especially if attribution is still expanding.

The report also underscores how on-chain forensic estimates can change as more linked addresses are uncovered. For hardware wallet users and the wider crypto industry, that keeps attention on both operational wallet security and the limits of post-theft asset tracing once attackers begin staging funds across multiple formats and networks.