The individual responsible for the Coldcard breach has shifted approximately $7.7 million worth of Bitcoin, according to on-chain data. This movement represents nearly half of the funds stolen in what has been described as the third wave of the attack.
Funds Spread Across 293 Vaults
The attacker had previously distributed the stolen Bitcoin across 293 separate vaults, a tactic likely intended to complicate tracking and slow down recovery efforts. Now, the wallet activity shows a systematic emptying process, with the largest vaults being drained first.
Draining in Order of Size
Blockchain analysts note that the attacker is not withdrawing funds randomly. Instead, the vaults are being emptied in descending order of their Bitcoin holdings. This methodical approach suggests a deliberate strategy, possibly to minimize transaction fees or to manage the liquidation process efficiently.
At the current pace, the remaining vaults—which hold the rest of the third-wave haul—could be targeted next, though no further transfers have been confirmed at this time.
