Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul

Decrypt09-07 11:09

In brief Galaxy Research said Monday that 97.09 BTC, worth about $7.7 million, has left the Wave 3 vaults. The coins went out through THORChain on September 2 and into CoinJoin rounds over the weekend...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2665319954?lang=en_US&edition=fundamental","thumbnail":"https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2026/07/coldcard-mk3-decrypt-style-1-2-gID_7.jpg@webp","is_english":true,"pubTime":"2026-09-07 11:09","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2665319954","market":"nz","top_or_hot":-1,"title":"Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul","media":"Decrypt","content":"<div>\n<p>In brief\nGalaxy Research said Monday that 97.09 BTC, worth about $7.7 million, has left the Wave 3 vaults.\nThe coins went out through THORChain on September 2 and into CoinJoin rounds over the weekend...</p>\n\n<a href=\"https://decrypt.co//377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul\">Source Link</a>\n\n</div>\n","source":"decrypt_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Coldcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nColdcard Hacker Moves $7.7M, Nearly Half of Third-Wave Bitcoin Haul\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-07 11:09 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://decrypt.co//377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul><strong>Decrypt</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>In brief\nGalaxy Research said Monday that 97.09 BTC, worth about $7.7 million, has left the Wave 3 vaults.\nThe coins went out through THORChain on September 2 and into CoinJoin rounds over the weekend...</p>\n\n<a href=\"https://decrypt.co//377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ETHU","symbol_name":"2倍以太币期货ETF-Volatility Shares","start_time":0,"source_url":"https://decrypt.co//377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul","article_id":"2665319954","we_media_id":null,"thumbnails":["https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2026/07/coldcard-mk3-decrypt-style-1-2-gID_7.jpg@webp"],"rights":{"source":"decrypt_highlight","url":"https://decrypt.co//377537/coldcard-hacker-moves-7-7m-nearly-half-of-third-wave-bitcoin-haul","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2665319954","pubTimestamp":1788750567,"columns":[],"sourceInfo":{"source_id":"decrypt_highlight","name":"Decrypt"},"weMediaInfo":null,"summary":"The attacker built 293 separate vaults for the stolen Bitcoin and is emptying them in order of size, largest first.","collect":0,"end_time":0,"defaultTopTitle":"decrypt.co","property":[],"viewcount":null,"language":"en","relate_stocks":{"ETHU":"2倍以太币期货ETF-Volatility Shares","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","QETH":"以太坊ETF-Invesco Galaxy","ETHV":"以太坊ETF-VanEck","BTF":"比特币&以太币期货ETF-CoinShares","ESK":"REX-Osprey ETH + Staking ETF","ETHW":"以太坊ETF-Bitwise","ETH":"低成本以太坊ETF-Grayscale","EETH":"以太币期货ETF-ProShares","FETH":"以太币ETF-Fidelity","ETHA":"以太坊ETF-iShares","TETH":"21Shares Ethereum ETF","IBIT":"比特币ETF-iShares","EZET":"以太坊ETF-Franklin","ETHD":"ProShares UltraShort Ether ETF","YETH":"Roundhill Ether Covered Call Strategy ETF","ETHE":"最大以太坊ETF-Grayscale","SETH":"1倍做空以太币期货ETF-Proshares","ETHI":"Defiance Leveraged Long Income Ethereum ETF","BITC":"Bitwise Trendwise Bitcoin and Treasuries Rotation Strategy ETF","ETCO":"Grayscale Ethereum Covered Call ETF","ETHT":"ProShares Ultra Ether ETF","ETU":"T-Rex 2X Long Ether Daily Target ETF"},"translate_title":"Coldcard 黑客转移了 770 万美元，几乎是第三波比特币收益的一半","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"SETH":0.6,"TETH":0.6,"ESK":0.6,"QETH":0.6,"EETH":0.6,"EZET":0.6,"ETHA":0.6,"YETH":0.6,"ETHW":0.6,"ETCO":0.6,"ETHT":0.6,"ETHI":0.6,"ETHD":0.6,"ETHU":0.6,"ETQ":0.6,"IBIT":0.6,"ETHE":0.6,"ETU":0.6,"ETHV":0.6,"FETH":0.6,"BITC":0.6,"BTF":0.6,"ETH":0.6},"content_text":"In brief\nGalaxy Research said Monday that 97.09 BTC, worth about $7.7 million, has left the Wave 3 vaults.\nThe coins went out through THORChain on September 2 and into CoinJoin rounds over the weekend.\nAcross the whole Coldcard exploit, 82% of the stolen Bitcoin has still not moved.\nThe attacker behind the third wave of thefts from Coldcard hardware wallets has moved 97.09 BTC, roughly 45% of that wave's haul and about $7.7 million at Monday's prices, according to Galaxy Research.The first exit came on September 2, when around 20.5 BTC from the largest vault went through THORChain and came out as Ethereum. The coins spent on Sunday night went into CoinJoin rounds instead, a Bitcoin privacy technique that pools transactions from multiple users to break the trail between inputs and outputs. Only 20.56 BTC actually reached Ethereum. Another 57.24 BTC is sitting unspent as CoinJoin change in a single address, and Galaxy says its trail ends on roughly 19 BTC more.\nColdcard ‘Wave 3’ exploiter continues to move funds\nIn wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim’s coins.\nThe first movements on 9/2 sent coins over THORChain to Ethereum.\nTonight’s movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah\n— Galaxy Research (@glxyresearch) September 7, 2026The vaults are the attacker's own construction. Galaxy said the operator built 293 two-of-two multisig addresses and has been working through them in order of size. Eleven are now empty. The next ten hold 30.81 BTC between them, and the 233 smallest hold 33.77 BTC.BitcoinBTC · USD$79,461−0.62%24H7D1M1YYTD11:45 AM05:45 PM11:45 PM05:30 AM11:30 AM$80.4k$80.0k$79.7k$79.3k24h HighHigh$80,49424h LowLow$79,081VolVol$822.5MMarket projectionsOdds by MyriadToday$78,000 to $80,000$78k–$80k83% chanceThis weekBelow $80,000Below $80k58% chancePrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →A flaw shipped in 2021The thefts trace to a firmware bug Coinkite introduced in March 2021, which rerouted seed generation off the device's hardware random-number chip and onto a software stand-in, collapsing key strength from 128 bits of entropy to as low as 40. That let attackers reconstruct private keys offline and drain single-signature addresses without ever touching the hardware. The sweeps began on July 30.Coinkite has overhauled the firmware, now at Mk4/Mk5 5.6.2 and Q 1.5.2Q, requiring owners to supply their own randomness through key presses, dice rolls or coin flips. An update still cannot repair a seed generated under the flawed version, and anyone whose wallet was created on affected firmware has to generate a fresh seed and move their coins to it. Coinkite chief executive Rodolfo Novak apologized in an open letter on July 31, writing that the company would have to \"earn back our users' trust.\" A full technical postmortem is still in preparation.Myriad: Bitcoin next price move? Click to make your prediction.Monday's thread also flagged a previously unknown vault fed by 58 addresses. Galaxy marks its cause as open but believes it another Coldcard victim, which would lift its published total for the exploit to about 1,806 BTC, or $143.9 million. Galaxy said in August it was also carrying an unconfirmed fourth wave of 638.5 BTC, which would take the total past 2,400, and had logged no attacker sweeps since August 6. Across all waves, 82% of the coins remain where the attackers first put them.Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.Your EmailGet it!Get it!","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.49.0","shortVersion":"4.49.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2665319954","isCrawlerRequest":true}