Coldcard's Wave 3 Thief Is Cashing Out, Largest Vaults First
Galaxy Research says the operator behind Wave 3 of the Coldcard thefts moved 97.09 BTC in the first week of September, through THORChain and CoinJoin. The vaults are being emptied in order of size, and the 11 biggest are already gone.
Update, October 22, 2026: the thefts have led to a proposed class action against Coinkite in Ontario. What it alleges, and why it won't bring back the coins tracked here, is in our breakdown of the claim.
The Wave 3 money is moving. Between September 2 and 6, the operator behind the third wave of Coldcard thefts pulled 97.09 BTC, about $7.7 million at September 7 prices, out of the vaults holding the loot, according to a Galaxy Research thread published September 7 [1][2]. That is roughly 45% of everything Wave 3 took [2].
Three exits in five days
- September 2: about 20.5 BTC from the largest vault went over THORChain, a decentralized cross-chain exchange, and landed on Ethereum.
- September 5: 15.48 BTC from the second-largest vault went into a CoinJoin.
- September 6: 61.12 BTC from ten more vaults followed.
Both routes make the trail harder to follow. A CoinJoin pools many users' coins into one transaction, which makes it harder to link inputs to outputs [2]. And whatever crosses to Ethereum stops being bitcoin.
Largest first
The order is the tell. Galaxy says the operator built 293 two-of-two multisig vaults, one per victim's coins, and is spending them by size, biggest first; ranks 1 through 11 were empty by September 7 [1][2]. These are the attacker's own vaults, not the victims' wallets [2].
What's left is thinner. The next ten vaults hold 30.81 BTC, and ranks 61 through 293 hold 33.77 BTC between them [2]. Spread over 233 vaults, that's about 0.14 BTC each on average.
Across all waves, 82% of the bitcoin stolen in the Coldcard exploit was still sitting in the original attacker-controlled addresses on September 7, per Galaxy Research [1][2]. The other 18% had moved in transactions that appear designed to obscure the trail [2].
One more vault, a higher total
Galaxy also found one more vault in the same two-of-two format, funded by 58 addresses. It is probably another Coldcard victim, but the origin is unconfirmed [1][2]. Counting it would put Wave 3 at 294 vaults and lift Galaxy's published total for the whole case to about 1,806 BTC, roughly $143.9 million [2].
Earlier counts from Galaxy and TRM Labs, each with its own date and method, are in our coverage of the case's escalation and the laundering offers.
Since September 7
Galaxy's numbers are a September 7 snapshot. Bitquery, an on-chain data firm running its own tracker on the case, reported on October 19, at block 972,117, that nothing had moved that day and that the last movement was on October 2 [3]. The single largest address in the case, holding 562.02 BTC, has never been touched, per the same tracker [3]. Bitquery notes its address set is narrower than Galaxy's, so the two are different snapshots of the same theft, not corrections of each other [3].
If you still use a Coldcard
Nothing changes on the device. Whether your seed is exposed depends on the model and firmware that created it, not on what the attackers do with stolen coins. If it falls in the affected range, the fix is the same as before: new seed, small test transaction, then the rest.
Watch your inbox, though. Bitquery warns that anyone offering to recover stolen bitcoin for a fee is a scammer [3]. Galaxy says it keeps helping victims trace their coins so they can file reports with the authorities [1].
Coldcard wasn't the only case this year where the chip held and people still lost money. We compare all three in this year's hardware wallet attacks and how to protect your seed. The rest of our self-custody coverage lives in the privacy and self-custody section.
Still sitting on a seed from an affected model? The step-by-step migration order is in our entropy flaw breakdown.
Sources
Labelled by type.
- Galaxy Research, Coldcard 'Wave 3' exploiter continues to move funds, September 7, 2026. Wave 3 vaults, THORChain exit, CoinJoin rounds, the unconfirmed vault and the moved-versus-unmoved split. (Primary, firm's thread on X)
- CoinDesk, Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave, September 7, 2026. Amounts per exit, remaining vault balances, dollar value and the ~1,806 BTC total, per Galaxy Research. (Secondary, press)
- Bitquery, Coldcard Hack Tracker Live, accessed October 20, 2026 (figures as of October 19, block 972,117). Last movement, the untouched largest address and the warning about fake recovery agents. (Secondary, on-chain tracker from a data firm, drafted with AI help per the firm)
More in Privacy and self-custody
Last updated: October 22, 2026