A suspected third wave of Coldcard-related bitcoin sweeps has pushed the estimated theft to 1,367 BTC, worth approximately $88.6 million, Galaxy Research says. Two other signals emerged over the same stretch of days: a sharp jump in exchange deposits and a batch of coins dormant for years suddenly moving.
Galaxy Research disclosed that three suspected waves have drained about 4,585 addresses and captured bitcoin worth approximately $88.6 million, cautioning that its findings are preliminary.
Third Wave Splits Funds Across 293 Vaults
The first wave was the largest, sweeping 1,082.65 BTC from 1,195 addresses in 41 minutes on July 30. A second wave collected 76.16 BTC from 1,478 addresses the next day. A third stretched from July 31 into Aug. 1, draining roughly 208 BTC from 1,912 addresses.
Unlike the first two waves, which funneled funds into a small number of collector addresses, wave three split the funds into 293 separate P2WSH vaults, addresses that can hide their spending conditions until the coins move. Galaxy said the change could indicate the original attacker rebuilt the operation after the earlier sweeps became public, or that another party found the same vulnerable pool of addresses — blockchain records alone cannot determine which explanation is correct.
Galaxy traced the vulnerability to a firmware release shipped March 17, 2021 for the Coinkite Coldcard hardware wallet. None of the affected coins were created before that date, and the median victim address had sat inactive for about 3.5 years, matching the behavior expected from long-term cold storage.
Exchange Deposits Jump by 11,163 BTC
Exchanges recorded net inflows of 11,163 BTC on July 31, per data from Sani of Timechainindex.com. River got an estimated 3,679 BTC, Binance 3,224 BTC, Kraken 2,848 BTC and OKX 1,291 BTC. Platforms took in 15,205 BTC collectively from unidentified addresses.
Large inflows often draw attention because deposited coins may be prepared for sale or collateral, but the data does not establish that the deposits came from Coldcard users or attackers. A security scare can prompt holders to move coins to exchanges, though the spike could also coincide with unrelated institutional transfers, leaving the signal inconclusive.
Coins Dormant Since 2010 Begin Moving
Separately, a slew of addresses created between 2010 and 2017 began moving coins after nine to 16 years of inactivity, according to data Bitcoin.com News collected from btcparser.com. Visible transfers from July 30 through Aug. 1 totaled about 306 BTC. One address created in July 2010 moved a coinbase transaction of over 50 BTC.
This activity cannot be tied to the Coldcard sweeps from available data: Galaxy Research noted the affected coins were all created after the 2021 firmware release, while many reactivated wallets held bitcoin years before Coldcard existed. The firm is now watching seven holding addresses from the first two waves and the 293 vaults from the third for the first outbound spend. Bitcoin traded below $63,000, at $62,326 at press time.
Source: Bitcoin News
Trading involves risk.
Risk Disclaimer
