According to Galaxy Research, the research arm of digital asset investment firm Galaxy Digital, the operator tied to Wave 3 of the Coldcard hardware wallet seed-generation thefts has moved roughly 45% of the Bitcoin held across that cluster of victim vaults, the research arm of Galaxy Digital said in a fresh on-chain update on Monday.
Galaxy Research said the moved coins have left operator-controlled addresses through THORChain, a decentralised cross-chain swap protocol, and through CoinJoin rounds, a Bitcoin privacy technique that pools transactions from multiple users to obscure fund flows.
Galaxy Research posted the update on X at 02:19 UTC on September 7, 2026, timestamped to Bitcoin block 965,863. The thread said the Wave 3 operator is emptying vaults from largest to smallest, and that spent proceeds have gone either to Ethereum via THORChain or into CoinJoin denominations.
This article is based primarily on that Galaxy Research thread and earlier Galaxy updates. The Crypto Times has not independently audited every transaction Galaxy cited.
A shift in method between cash-outs
The Sept. 7 update follows the first confirmed cash-out from any of Waves 1, 2, or 3. On Sept. 2, 2026, Galaxy Research head Alex Thorn reported that Wave 3 coins had left original attacker addresses and been swapped to ether over THORChain, in a follow-up thread that also mapped the initial exit path. The Crypto Times covered that first movement in Coldcard Hacker Converts ~20.5 Bitcoin to ETH After Weeks of Inactivity.
Galaxy’s new charts show a change in method between spends. The Sept. 2 exit used THORChain, while the Sept. 5 and Sept. 6 exits used CoinJoins.
How Wave 3 is mapped on chain
According to Galaxy, the Wave 3 operator created 293 separate 2-of-2 multisignature vaults, meaning each holding wallet requires signatures from two of two designated keys to spend, with one dedicated set of holding addresses for each victim cluster rather than a single shared collector.
Its end-to-end diagram lists 1,912 victim addresses and 300 sweeps dated July 31, 2026, totalling 208.24 BTC; 293 collection addresses holding the same 208.24 BTC; and 293 pay-to-witness-script-hash (P2WSH) vaults, a native SegWit script type, forwarded on Aug. 1, 2026 and holding 207.73 BTC after network fees. Twelve of those vaults were spent between Sept. 2 and Sept. 7, moving 97.09 BTC in total, while 282 vaults remain unspent and hold 116.98 BTC.
A separate 58-address cluster swept on Aug. 3, 2026, worth 6.35 BTC, later surfaced as one extra vault of 6.34 BTC. Galaxy marked that vault as “cause = open,” but said it is likely another Coldcard victim set because it used the same 2-of-2 script format and was co-spent by the Wave 3 operator into a hop address that funded a CoinJoin. If counted, Wave 3 would rise to 294 vaults and Galaxy’s published Coldcard total would move to about 1,806 BTC.
Tracing the operator’s exits
Galaxy said the operator is emptying the vaults in descending order of size.
The largest vault, ranked one, moved on Sept. 2, 2026, at 20:00 UTC in block 965,217, sending 20.50 BTC through THORChain to two Ethereum addresses. Galaxy said those Ethereum proceeds were subsequently emptied.
The second-ranked vault moved on Sept. 5, 2026, at 14:41 UTC in block 965,625, sending 15.48 BTC to a Taproot address, a Bitcoin script type introduced in the Taproot soft fork, before entering a CoinJoin round 84 minutes later.
Vaults ranked three through eleven, together with the extra flagged vault, moved on Sept. 6, 2026, at 23:38 UTC in block 965,850, forwarding 61.12 BTC to a Taproot address that fed a CoinJoin 56 minutes later. Galaxy listed 57.24 BTC of that batch as operator CoinJoin change still unspent in one address, 12.90 BTC as CoinJoin change routed through a second round, and 6.46 BTC as standard CoinJoin denominations whose trail ends there.
The next ten unmoved vaults hold 30.81 BTC. Vaults ranked 61 through 293 hold 33.77 BTC.
Wider Coldcard picture
Galaxy first identified Wave 3 on Aug. 1, 2026, at 207.7294 BTC, putting the observed Coldcard total at 1,367.05 BTC, or about $88.6 million, across 4,585 addresses, as reported in Coldcard Hack Tops $88.6M as Galaxy Finds Third Attack Wave.
Subsequent Galaxy tallies rose to 1,719 BTC, or about $111 million, on Aug. 8, 2026, detailed in Galaxy Research Confirms $111M Stolen Funds in Coldcard Exploit, and to at least 1,778.84 BTC, about $112 million, across more than 8,600 addresses on Aug. 19, 2026, as noted in Block and Galaxy Research Give Lead to Law Enforcement in $112M Coldcard Bitcoin Theft. Galaxy’s Sept. 3, 2026, cash-out report cited high-confidence losses near 1,789 BTC and $115 million across more than 8,800 addresses.
The Sept. 7 thread did not replace those dated snapshots with a full new table, but Galaxy said the newly co-spent vault “would push our published total to ~1806 BTC.”
On the wider investigation, Galaxy said about 82% of coins it attributes to the Coldcard exploit remain in original attacker-controlled addresses. In comparison, about 18% have been moved in a pattern it described as apparent laundering. The 45% figure applies only to the Wave 3 vault cluster now being spent.
Background on the thefts
The first large sweep began on July 30, 2026. Manufacturer Coinkite published a security advisory the same day, stating that Coldcard devices were not remotely taken over. A firmware bug in affected releases weakened seed generation, allowing attackers to regenerate private keys offline and spend the corresponding funds.
Coinkite said funds are at risk if the seed was created on affected firmware without at least 50 independent private dice rolls and without a strong, unique BIP-39 passphrase, a passphrase feature specified under Bitcoin Improvement Proposal 39 that is added on top of a seed. Firmware updates do not repair an existing seed. The company later published fixed firmware guidance and said customers with affected seeds should generate a new seed on fixed firmware and move funds.
Galaxy has described multiple waves and more than one attacker footprint. Wave 3 is distinct on-chain because each victim cluster received its own collection address and its own vault, which made clustering harder than the shared collectors used in earlier waves.
Victim tracing
Galaxy said it is still helping victims trace coins so they can file theft reports with authorities. The firm asked victims to contact Alex Thorn on X and said it continues to share findings with industry partners and law enforcement.
Also Read: Core DAO Fixes Reward Exploit, Claws Back 186M CORE
