Coldcard exploiter moves 45% of stolen Wave 3 funds, but could millions in Bitcoin still be at risk of being laundered?

The Coldcard attacker behind the third wave of the 2026 wallet thefts has moved about 45% of the Bitcoin tied to Wave 3, sending funds through THORChain and CoinJoin transactions as investigators continue tracking the flow. The movement is significant, but the bigger concern may be the much larger pool of stolen Bitcoin that remains in attacker-controlled addresses and could still be moved later.

The incident also goes beyond a typical hardware wallet breach because Coinkite says the devices were not remotely hacked or taken over. A firmware flaw weakened the randomness used to generate wallet seeds, allowing attackers to recreate vulnerable private keys offline and drain funds.

How much Bitcoin has the Coldcard attacker moved?

The Wave 3 attacker has now moved about 97.09 BTC, worth roughly $7.8 million at the prices cited in the latest reporting. Galaxy Research said the funds were taken from the largest vaults first, with the 11 biggest vaults now processed.

The transfers have followed two main paths that make the stolen funds harder to track in a simple way. Some Bitcoin was routed through THORChain into Ethereum, while other amounts were sent into CoinJoin transactions on the Bitcoin network.

Galaxy said the attacker created 293 two-of-two multisignature vaults during Wave 3, with each vault associated with one victim’s funds. The attacker has been working through those vaults in descending order of size, leaving smaller pools for later.

The next 10 untouched vaults contain about 30.81 BTC, while vaults ranked 61 through 293 hold another 33.77 BTC combined. That means the attacker still has a measurable amount of Wave 3 Bitcoin available to move even after draining the largest wallets.

Galaxy also identified a previously unknown wallet structure containing 58 addresses that appear to use the same two-of-two multisignature format linked to Wave 3. The company believes it may belong to another Coldcard victim, which could raise the total number of Wave 3 vaults from 293 to 294.

The larger concern is the full Coldcard incident rather than Wave 3 alone. Galaxy had already identified about 1,778.84 BTC stolen from 190 victims by mid-August, and the newly identified wallet could push the total theft estimate to around 1,806 BTC.

Why is the untouched Bitcoin still a major risk?

About 82% of the Bitcoin stolen across the Coldcard incident remains in the original attacker-controlled addresses, according to Galaxy Research. That means the largest portion of the stolen funds has not yet entered the latest movement phase.

This creates a different kind of risk from the immediate theft itself. Even if the attacker pauses activity, the unmoved Bitcoin remains available for future transfers, giving investigators another large set of transactions to monitor.

Galaxy previously estimated that roughly 1,531 BTC remained unmoved after about 246 BTC had been moved following the thefts. The research firm said 65% of the moved amount had entered CoinJoin transactions, while the remainder continued moving on chain through additional transaction patterns.

The fact that most stolen Bitcoin is still sitting in known addresses could actually help investigators in some ways. Funds that have not moved remain easier to identify and flag than funds that have already passed through multiple services and networks.

The situation could become more complicated if the remaining Bitcoin begins moving in larger batches. A coordinated transfer campaign could generate hundreds of new transactions and force exchanges, compliance companies, and investigators to track new addresses and potential conversion points.

Galaxy has already shared lists of attacker addresses with cryptocurrency exchanges, compliance firms, investigative companies, and law enforcement agencies. The goal is to give centralized intermediaries a chance to identify and potentially freeze stolen funds if they reach platforms where intervention is possible.

Fun fact: Most funds remain in the original addresses, but 18% have been relocated. Real-world assets (RWA) news highlights continued monitoring of these movements.

How do THORChain and CoinJoin make the trail harder to follow?

THORChain matters because it allows the attacker to move value from Bitcoin into another blockchain environment. Galaxy observed the attacker sending Bitcoin through THORChain and receiving Ethereum, creating a cross-chain path that investigators must follow across separate networks.

The cross-chain move does not automatically make the money untraceable. Blockchain transactions remain publicly visible, but the investigative process becomes more complex because analysts must connect activity across different chains and assets.

CoinJoin works differently because it operates within Bitcoin transactions. CoinDesk explained that CoinJoin combines multiple users’ payments into a transaction, making it more difficult to determine which original inputs correspond to later outputs.

That makes CoinJoin especially relevant to the laundering question in this case. Sending stolen Bitcoin into a mixing transaction can obscure the transaction relationships that investigators normally use to trace money from one address to another.

Still, moving funds through CoinJoin or across THORChain does not prove that the attacker has successfully converted the Bitcoin into clean money. The movement shows an attempt to obscure the trail, while an actual laundering outcome would depend on whether the attacker can eventually convert or spend the assets without being stopped.

This distinction is important because headlines can make laundering sound like a completed event. In reality, blockchain analysts can continue following addresses, exchanges can flag suspicious deposits, and law enforcement can potentially intervene when stolen funds touch identifiable services.

What caused the Coldcard theft in the first place?

The Coldcard incident was caused by a seed generation flaw rather than a remote takeover of the hardware wallet. Coinkite says the devices themselves were not hacked, accessed remotely, or physically controlled by the attackers.

During a 2021 software migration, the seed generation path ended up using MicroPython’s Yasmarang software pseudorandom number generator instead of the hardware random number generator that Coldcard was designed to use. That reduced the randomness available to certain wallet seeds and created a smaller search space that attackers could exploit offline.

The weakness was especially serious because Bitcoin security depends heavily on the secrecy and unpredictability of private keys. If an attacker can reproduce the seed that generated a wallet, the attacker can recreate the corresponding private keys without ever touching the physical device.

Coinkite said attackers used this weakness to regenerate vulnerable seeds and then sweep funds from affected single-signature addresses. This explains why the theft could occur without the attacker breaking into individual devices or stealing users’ hardware.

The timeline makes the issue more significant because the flawed seed generation path was introduced during the March 2021 libNgU migration. That means the vulnerability existed long before the thefts became visible in July 2026.

The episode also shows why hardware wallets cannot be judged only by whether the device is physically isolated. A hardware wallet can keep private keys away from an internet-connected computer and still face serious risk if the software that generates those keys does not produce strong enough randomness.

Fun fact: The Coldcard exploit ranks as the third-largest exploit so far in 2026, behind a $293 million Kelp DAO hack and the $280 million Drift protocol hack, according to DefiLlama.

Why does a firmware update not make an affected wallet safe?

A firmware update fixes new seed generation, but it cannot repair a seed that was already created using the vulnerable process. Coinkite explicitly warns affected users that upgrading alone is not enough and that they need to create a new seed and move their funds.

The current fixed releases address the underlying issue for new seeds. Coinkite says affected devices received fixed firmware across the Mk2, Mk3, Mk4, Mk5, and Q product lines, with separate release tracks for standard and Edge firmware.

The company also says users who created seeds on certain affected firmware may be at risk if they did not add at least 50 fair, independent, private dice rolls and did not protect the wallet with a strong, unique BIP 39 passphrase. The guidance differs by device and firmware generation, so users are directed to the official migration process rather than relying on a simple firmware version check.

A BIP 39 passphrase can provide an additional barrier because an attacker would need both the weakened seed and the passphrase to access the protected wallet. Coinkite still recommends migration because a strong passphrase reduces exposure but does not repair the underlying compromised seed.

The distinction between a passphrase and a device PIN is also important. Coinkite’s guidance specifically refers to a BIP 39 passphrase as an independent secret, meaning users should not assume that their normal Coldcard PIN provides the same protection.

Coinkite’s most recent firmware update, released in early September, again warns that upgrading does not make an existing vulnerable seed safe. The company says users whose seeds may have been generated on affected firmware from 2021 through July 2026 should create a completely new seed using fixed firmware and complete the migration process.

Could millions in Bitcoin still be laundered from the Coldcard exploit?

Yes, the risk remains because a large majority of the stolen Bitcoin has not moved yet. The 82% still sitting in attacker-controlled addresses gives the exploiter a substantial reserve that could enter mixing services, cross-chain routes, exchanges, or other transaction paths later.

The latest Wave 3 activity also suggests that the attacker is following an organized process rather than moving coins randomly. By emptying the largest vaults first, the operator can prioritize the addresses containing the greatest amount of Bitcoin before moving to smaller pools.

That pattern gives investigators a useful clue about what could happen next. The remaining vault rankings provide a rough map of where additional stolen funds may emerge if the attacker continues the same strategy.

The discovery of a possible 294th vault adds another layer of uncertainty. If more victim addresses are identified, the total amount stolen could rise again even without a new attack wave against Coldcard devices.

The best defense now is continued monitoring and rapid intervention when stolen Bitcoin reaches a point where centralized services can identify it. The fact that Galaxy has already distributed attacker address information to exchanges and law enforcement means the stolen coins are not moving through an environment with no oversight.

The Coldcard case therefore remains an active security and tracing problem even though the original seed generation vulnerability has been fixed for new wallets. About 45% of Wave 3 has already moved, but the larger question is whether the remaining Bitcoin stays dormant, enters additional mixing and cross-chain routes, or eventually reaches an exchange where investigators have a better chance of stopping it.

TL;DR

• The Coldcard Wave 3 attacker has moved about 45% of the stolen Bitcoin, or roughly 97 BTC worth $7.7 million.
• The attacker has used THORChain and CoinJoin to make tracing the stolen funds more difficult.
• About 82% of the Bitcoin stolen across the broader Coldcard exploit remains in attacker-controlled addresses, leaving a much larger pool potentially at risk.
• The attack was caused by a seed-generation randomness flaw, not a remote takeover of Coldcard hardware.
• Updating affected devices is not enough because vulnerable seeds must be replaced with new, securely generated seeds.
• Investigators are continuing to monitor the stolen Bitcoin, while newly identified wallets could push the estimated total loss to around 1,806 BTC, or roughly $144 million.

This article was made with AI assistance and human editing.

If you liked this, you might also like:

• Could SWIFT’s blockchain solution challenge XRP as banks move deeper into tokenized payments?
• Could Tether’s failed $120 million Bitcoin mining project expose a bigger problem with mining costs?
• Could the Term Labs hack become another warning about vulnerabilities across DeFi?