Coldcard Exploit Sees Significant Bitcoin Movement by Third-Wave Attacker
- The third-wave attacker has created 293 two-of-two multisignature vaults to store stolen coins.
- Funds from the 11 largest vaults have been moved in descending order of size.
- Approximately 82% of the stolen Bitcoin remains in addresses controlled by the attacker.
- Only 18% of the stolen funds have been moved, likely for laundering purposes.
- This exploit ranks as the third-largest in 2026, following a $293 million Kelp DAO hack and a $280 million Drift protocol hack.
The ongoing investigation into the Coldcard exploit reveals significant movement of funds, indicating active attempts at laundering stolen assets. The identification of new vaults suggests that more victims may be affected, complicating recovery efforts.
As of now, only 18% of the stolen Bitcoin has been transferred from its original addresses, highlighting ongoing challenges in tracking and recovering these assets.(Source)
