News linked to both this project and an event.
According to Galaxy Research, in the Coldcard wallet attack incident, the Wave 3 attacker has transferred approximately 45% of the stolen Bitcoin, with the related funds routed to Ethereum via THORChain or entering CoinJoin transactions to increase tracking difficulty. Galaxy stated that the attacker previously created 293 2-of-2 multisig vaults to hold victim funds, draining them from largest to smallest amount, and the funds in the 11 largest vaults have now been fully transferred out.
Odaily News: The attacker behind the Coldcard "Wave 3" exploit continues to move stolen funds. In this phase, the attacker created 293 separate 2-of-2 multisig vaults for each victim's assets. On September 2, the first batch of funds was bridged to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attacker is processing the largest holdings in descending order by stolen amount, having already transferred vaults ranked 1 through 11 in sequence. The next 10 vaults yet to be transferred collectively hold 30.81 BTC, while vaults ranked 61 through 293 collectively hold 33.77 BTC.To date, the attacker has moved approximately 45% of the assets stolen in this exploit, with funds either flowing to Ethereum or entering CoinJoin mixing transactions. This latest transfer activity has also revealed a previously unknown vault: 58 addresses jointly spent funds via a 2-of-2 multisig setup in the same format as Wave 3, with the Wave 3 attacker subsequently routing them to a jump address that funds CoinJoin transactions.This vault is currently marked with "cause = open," but it is highly likely to belong to Coldcard victims as well, which could bring the total number of vaults involved in Wave 3 to 294 and push the previously disclosed total stolen in the Coldcard exploit to approximately 1,806 BTC. At present, roughly 82% of the stolen BTC remains in addresses initially controlled by the attacker, while approximately 18% has been moved, with fund flows suggesting it may be undergoing laundering.
Odaily News: According to monitoring by Galaxy's Head of Research, the COLDCARD Wave 3 attacker has moved stolen funds for the first time, exchanging them for ETH via the THORChain cross-chain DEX. This marks the first on-chain transfer of funds from the original hacker address across Waves 1, 2, or 3.
Odaily News, Galaxy Research Head Alex Thorn stated on the X platform that attacks exploiting the Coldcard hardware wallet vulnerability have noticeably declined, but cumulative losses continue to rise as more victims come forward. The impact of this incident on the Bitcoin community is significant, as the victims are primarily long-term BTC holders who adhered to self-custody cold storage principles, rather than those who lost assets due to high-risk trading or DeFi activities.At a scale of $112 million, this incident ranks among the top 20 largest hacks in crypto history and is one of the most severe security breaches in the hardware wallet self-custody sector to date. Bitcoin culture may be entering a new phase—the era of relying solely on ideological advocacy and extreme self-custody promotion is coming to an end. The community needs to place greater emphasis on technical security, lower the barrier to entry for users, and avoid simply shifting the burden of security responsibility onto ordinary users. This crisis may ultimately drive the Bitcoin ecosystem to establish a more mature security framework.Galaxy Research has directly contacted 190 victims and has confirmed with high confidence that the exploit has led to the theft of 1,778.84 BTC (approximately $112.7 million) from over 8,600 addresses. This tally does not yet include certain moderately credible suspicious attack records, such as the unconfirmed "Wave 4." If these potential attack scopes are incorporated, total losses could expand to 2,417.35 BTC (approximately $153 million).Meanwhile, the incident is reshaping market perceptions of self-custody security. Galaxy noted that multisig wallets have emerged as the "winners" of this event, with no stolen transactions traced to multisig wallets so far. Multisig service providers including Casa, Unchained, Nunchuk, and Anchorwatch have all observed a notable increase in user registrations and BTC inflows.
Odaily News: In an interview with CNBC's "Squawk Box," former White House Senior Advisor for Artificial Intelligence Policy, Sriram Krishnan, stated that a wave of cybersecurity startups leveraging AI to fight AI will emerge in the future.As AI model capabilities rapidly advance, especially with the increasing risk of "rogue AI models" capable of autonomous operation, the cybersecurity landscape will require new defense systems, including using AI technology to identify, monitor, and block AI-driven attacks in real time.Sriram Krishnan believes that the future of cybersecurity competition will evolve into an "AI offensive-defensive battle." Attackers may use AI to automatically discover vulnerabilities and launch attacks, while defenders must also rely on AI to enhance threat detection and response capabilities. This will create opportunities for a new generation of cybersecurity startups.During the interview, Krishnan also discussed topics such as the competitive landscape of the AI industry, Nvidia's $500 billion financing plan, and the global AI arms race. He pointed out that as investment in AI infrastructure continues to expand, computing power, model security, and network protection will become key components of the AI ecosystem.
Odaily News: According to monitoring by Galaxy's Head of Research, a suspected organized Coldcard attack is underway, with similar transactions still in the mempool awaiting confirmation. Previously confirmed transactions show RBF (Replace-By-Fee) enabled. Between blocks 960,778 and 960,792, 218 transactions occurred within approximately 2.5 hours, involving 462 victim addresses, 216 new destination addresses, and 388.92748828 BTC. None of the transactions had inputs predating the Coldcard firmware boundary. The sweep rate during this period was 13.8 times per block, compared to a baseline of 0.3 times per block in the pre-incident control window—approximately 45 times higher. The transaction topology is 1:1, with each victim address corresponding to a single new destination address. Only one destination address received two sweeps, and no consolidation addresses were observed. Some funds have already been swept to second-hop addresses.