BTC $77,554.34 +0.41%
ETH $2,506.10 -0.62%
BNB $723.28 -0.70%
XRP $1.36 -0.32%
SOL $100.79 -1.02%
TRX $0.3386 -0.47%
DOGE $0.0838 -1.17%
ADA $0.2077 +0.02%
BCH $223.66 -0.94%
LINK $11.37 -1.15%
HYPE $79.01 -0.42%
AAVE $126.10 -0.49%
SUI $0.7155 -1.53%
XLM $0.1802 +0.19%
ZEC $1,090.07 -3.17%
AAPL $329.85 -0.97%
AMZN $255.06 -0.75%
GOOGL $336.46 -1.46%
MSFT $494.02 -0.34%
META $641.34 -1.13%
NVDA $215.26 -1.23%
TSLA $361.54 -1.60%
SNDK $1,572.15 -3.31%
INTC $99.21 -2.24%
SPCX $148.90 -0.92%
MU $943.90 -2.44%
AMD $502.37 -2.36%
BTC $77,554.34 +0.41%
ETH $2,506.10 -0.62%
BNB $723.28 -0.70%
XRP $1.36 -0.32%
SOL $100.79 -1.02%
TRX $0.3386 -0.47%
DOGE $0.0838 -1.17%
ADA $0.2077 +0.02%
BCH $223.66 -0.94%
LINK $11.37 -1.15%
HYPE $79.01 -0.42%
AAVE $126.10 -0.49%
SUI $0.7155 -1.53%
XLM $0.1802 +0.19%
ZEC $1,090.07 -3.17%
AAPL $329.85 -0.97%
AMZN $255.06 -0.75%
GOOGL $336.46 -1.46%
MSFT $494.02 -0.34%
META $641.34 -1.13%
NVDA $215.26 -1.23%
TSLA $361.54 -1.60%
SNDK $1,572.15 -3.31%
INTC $99.21 -2.24%
SPCX $148.90 -0.92%
MU $943.90 -2.44%
AMD $502.37 -2.36%

xy

All
Article
Flash

Galaxy Research: Coldcard attackers continue to transfer funds, approximately 45% of the stolen assets have entered mixing or cross-chain pathways

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.
app_icon
ChainCatcher Building the Web3 world with innovations.