Coldcard attacker moves 97 BTC as losses reach 1,806 BTC

• The Coldcard exploit has now linked about 1,806 Bitcoin (CRYPTO:BTC) to stolen funds.
• About 18% of the stolen Bitcoin has moved, while 82% remains in attacker-controlled addresses.
• Galaxy Research says the latest wave involved 294 separate multisig vaults.

The Coldcard exploit has now linked about 1,806 Bitcoin (CRYPTO:BTC) to stolen funds across multiple attack waves.

Galaxy Research says about 18% of the stolen Bitcoin has moved, while 82% remains in the attacker’s original addresses.

The latest wave involved 293 two-of-two multisig vaults, with Galaxy later identifying a 294th vault likely linked to the attack.

About 45% of the Bitcoin stolen in the latest wave has since moved through THORChain and CoinJoin transactions.

Galaxy previously confirmed at least 1,778.84 BTC stolen from 190 victims and more than 8,600 addresses, before the latest findings increased the total.

The latest stolen Bitcoin came from a Coldcard firmware flaw that exposed private keys from affected devices.

Galaxy has advised users with funds on affected single-signature Coldcard wallets to move them to new addresses as investigators continue tracking the stolen Bitcoin.

At the time of reporting, Bitcoin price was $79,277.45.