BTC $78,896.89 -1.09%
ETH $2,484.17 -0.94%
BNB $738.49 -1.39%
XRP $1.39 -1.27%
SOL $103.10 -2.18%
TRX $0.3347 -0.16%
DOGE $0.0898 -0.09%
ADA $0.2182 -1.14%
BCH $257.19 +0.04%
LINK $12.61 -3.48%
HYPE $83.99 -2.78%
AAVE $131.04 -2.16%
SUI $0.8210 +2.27%
XLM $0.1891 +0.96%
ZEC $1,126.48 -5.48%
BTC $78,896.89 -1.09%
ETH $2,484.17 -0.94%
BNB $738.49 -1.39%
XRP $1.39 -1.27%
SOL $103.10 -2.18%
TRX $0.3347 -0.16%
DOGE $0.0898 -0.09%
ADA $0.2182 -1.14%
BCH $257.19 +0.04%
LINK $12.61 -3.48%
HYPE $83.99 -2.78%
AAVE $131.04 -2.16%
SUI $0.8210 +2.27%
XLM $0.1891 +0.96%
ZEC $1,126.48 -5.48%

fun

All
Article
Flash

Galaxy Research: Coldcard attackers continue to transfer funds, approximately 45% of the stolen assets have entered mixing or cross-chain pathways

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.
app_icon
ChainCatcher Building the Web3 world with innovations.