A Third Wave Expands the Damage
Galaxy Research disclosed on X that the three suspected waves drained about 4,585 addresses and captured bitcoin worth approximately $88.6 million at the time of its analysis. The research group cautioned that its findings are preliminary and based entirely on publicly available Bitcoin blockchain data. Another dashboard called Coldcard Sweep Watch is placing the theft at 1,158.8480 $BTC at 5 p.m. EDT on Saturday.
According to Galaxy’s researchers, the first wave was the largest, sweeping 1,082.65 $BTC from 1,195 addresses in 41 minutes on July 30. A second operation collected 76.16 $BTC from 1,478 addresses the following day. The third wave stretched from July 31 into Aug. 1 and drained roughly 208 $BTC from 1,912 addresses.
That third operation did not look like a simple continuation of the first two. Waves 1 and 2 funneled funds through a small number of collector and holding addresses. Wave 3 instead sent victims’ funds into 293 separate P2WSH vaults, a type of bitcoin address that can hide its spending conditions until the coins move.
The separate vaults make it harder for outside observers to group the funds together. Galaxy explained that the change could indicate that the original attacker rebuilt the operation after the first sweeps became public, or that another party found the same vulnerable pool of addresses. Blockchain records alone cannot determine which explanation is correct.
Galaxy connected the activity to a vulnerable Coinkite Coldcard firmware release shipped on March 17, 2021. None of the affected coins were created before that release, and the median victim address had remained inactive for about 3.5 years, matching the behavior expected from long-term cold storage.
Exchange Deposits Add a Second Signal
As researchers mapped the suspected thefts, centralized cryptocurrency exchanges recorded a sharp increase in bitcoin deposits on July 31. Data shared by Sani of Timechainindex.com showed net exchange inflows of 11,163 $BTC during the day.
River received an estimated 3,679 $BTC, followed by Binance with 3,224 $BTC, Kraken with 2,848 $BTC, and OKX with 1,291 $BTC. Centralized entities collectively received 15,205 $BTC from unidentified addresses, lifting their reported holdings massively in a single day.
Large exchange inflows often attract attention because coins deposited at trading platforms may be prepared for sale, collateral, or internal custody transfers. The data does not establish that the July 31 deposits came from Coldcard users, attackers or anyone responding directly to the incident.
The timing is still quite notable. A security scare can most definitely prompt holders to reorganize storage, move coins to exchanges, or abandon wallet setups they no longer trust. It can also coincide with unrelated institutional transfers, customer deposits, and exchange bookkeeping, making the inflow spike important but inconclusive.
Lots of Dormant Bitcoin Starts Moving
A third development emerged as a large slew of addresses created between 2010 and 2017 began moving coins after nine to 16 years of inactivity, according to statistics Bitcoin.com News collected from btcparser.com. Visible transactions from July 30 through Aug. 1 totaled about 306 $BTC, including repeated transfers of 10 $BTC and 30 $BTC.
One address created July 2, 2010, moved an old coinbase transaction of over 50 $BTC. Other transactions included 37.8 $BTC from a 2014 address and a coordinated group of transfers from three wallets created on July 29, 2017. Those three wallets moved 37.5 $BTC and two separate 30 $BTC amounts in the same block.
The dormant activity cannot be tied to the Coldcard sweeps from the available data. In fact, Galaxy Research detailed that the suspected victims’ coins were all created after the vulnerable firmware was released in 2021, while many of the newly active dormant wallets held bitcoin years before Coldcard existed.
However, much like the exchange activity Sani reported, long-dormant bitcoin ($BTC) holders may be questioning their security setups and shifting funds to alternatives, including custodial services.
As far as what we do know, Galaxy Research disclosed that it is monitoring seven holding addresses from the first two waves and 293 vaults from the third. The first spend from those vaults could expose their scripts and reveal whether the same signing keys or spending structure appear across multiple addresses.
At press time, online sentiment remained deeply bearish, with $BTC trading below $63,000 at precisely $62,326 per coin.