The attacker behind the 'third wave' of Coldcard hardware wallet breaches has officially moved 45% of their stolen Bitcoin, signaling the start of a major laundering phase in early 2026. According to data from Galaxy, this specific attacker is significantly more active than their predecessors; across all recorded Coldcard-related thefts, approximately 18% of the total aggregate stolen funds have now been moved, while 82% remain dormant in the original hacker-controlled addresses.
This movement comes after a series of sophisticated supply chain and phishing attacks that targeted Coldcard users throughout late 2025. Galaxy’s intelligence suggests that the third-wave attacker is currently utilizing cross-chain bridges and privacy-enhancing protocols to obscure the trail of the illicit BTC. For US-based victims, this activity is a critical development, as it represents the highest likelihood of these funds being converted into fiat or other assets via global exchanges.
The timing of these transfers is particularly notable given the 2026 regulatory landscape in the United States. With the Treasury Department’s recent updates to anti-money laundering (AML) requirements for self-hosted wallet interactions, the attackers may be attempting to move the funds before new, more stringent tracking tools are fully deployed by federal authorities. The fact that nearly half of the third-wave haul is in motion suggests an urgency to bypass upcoming surveillance upgrades.
For the broader crypto market, the movement of these funds creates localized sell pressure and serves as a reminder of the persistent security risks within the hardware wallet ecosystem. Investors and security analysts should watch the remaining 82% of dormant Bitcoin; any sudden movement in those older addresses would indicate a coordinated liquidation effort that could impact Bitcoin's short-term price stability.