Coldcard Wave 3 exploiter moves 45% of stolen BTC as Galaxy maps the haul
Nearly half the bitcoin taken in what Galaxy Research calls the "Wave 3" attacks on Coldcard hardware wallet users has moved on-chain, the firm says. As of mid-August, Galaxy had identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses. The 55% still at rest is the figure to watch.
Key takeaways
- Galaxy Research says nearly half (45%) of the bitcoin stolen in the 'Wave 3' attacks on Coldcard hardware wallet users has moved on-chain.
- As of mid-August, Galaxy had identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses.
- The remaining 55% of the stolen bitcoin is still at rest and has not moved.
- Galaxy has not disclosed where the moved portion of the funds landed.
- The scope spanning 8,600-plus addresses and 190 victims, attributed to a single campaign, indicates a broad operation.
Nearly half the bitcoin taken in what Galaxy Research calls the "Wave 3" attacks on Coldcard hardware wallet users has moved on-chain, the firm says. As of mid-August, Galaxy had identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses. The 55% still at rest is the figure to watch.
The address count is where the scope of this campaign becomes concrete. More than 8,600 addresses tied to 190 victims tells you this was not a narrow operation, and Galaxy's ability to attribute that footprint to a single campaign is what makes the 45% fund movement significant for anyone watching $BTC on-chain flow.
Galaxy has not detailed where the moved portion landed. The 1,779 BTC total, 190 victims, and 8,600-plus addresses are Galaxy's confirmed baselines as of mid-August. Any revision to those figures, or a fresh movement update from the firm, is where this story moves.
Related reading
Filed by the digital assets desk of MarketPR on September 7, 2026. Source: theblock.co. Indicative figures are not investment advice.