A suspected third wave of Coldcard-related bitcoin sweeps has pushed the observed incident to an estimated 1,367 BTC, while exchange deposits and long-dormant wallet activity have added two more signals for analysts to watch.
Key Takeaways
Galaxy tracked 1,367 BTC swept from 4,585 addresses across 3 waves.Binance and other exchanges added a net 11,163 BTC on July 31.Galaxy is watching 300 attacker addresses for the first outbound spend.That third operation did not look like a simple continuation of the first two. Waves 1 and 2 funneled funds through a small number of collector and holding addresses. Wave 3 instead sent victims’ funds into 293 separate P2WSH vaults, a type of bitcoin address that can hide its spending conditions until the coins move.
The separate vaults make it harder for outside observers to group the funds together. Galaxy explained that the change could indicate that the original attacker rebuilt the operation after the first sweeps became public, or that another party found the same vulnerable pool of addresses. Blockchain records alone cannot determine which explanation is correct.
Exchange Deposits Add a Second SignalRiver received an estimated 3,679 BTC, followed by Binance with 3,224 BTC, Kraken with 2,848 BTC, and OKX with 1,291 BTC. Centralized entities collectively received 15,205 BTC from unidentified addresses, lifting their reported holdings massively in a single day.
Large exchange inflows often attract attention because coins deposited at trading platforms may be prepared for sale, collateral, or internal custody transfers. The data does not establish that the July 31 deposits came from Coldcard users, attackers or anyone responding directly to the incident.
Lots of Dormant Bitcoin Starts MovingOne address created July 2, 2010, moved an old coinbase transaction of over 50 BTC. Other transactions included 37.8 BTC from a 2014 address and a coordinated group of transfers from three wallets created on July 29, 2017. Those three wallets moved 37.5 BTC and two separate 30 BTC amounts in the same block.
As far as what we do know, Galaxy Research disclosed that it is monitoring seven holding addresses from the first two waves and 293 vaults from the third. The first spend from those vaults could expose their scripts and reveal whether the same signing keys or spending structure appear across multiple addresses.
