The Coldcard Exit: Ranks, Vaults, and the Algorithm Draining Wave 3

On September 2, the first coins moved. Not a panicked sweep. Not an emotional dump. An ordered execution, one vault at a time. Galaxy Research has now confirmed what the on-chain record already suggested: the operator behind the third wave of the Coldcard exploit has moved 45 percent of that wave’s haul. The remaining assets are not scattered. They are queued. Rank 1 through rank 11 have already been spent. Rank 12 waits. Somewhere below it, another rank waits too. This is the signature of a liquidation engine, not a thief improvising under pressure. Let me pause on the numbers because the numbers are doing the real speaking. Wave 3 produced 293 two-of-two multisig vaults. Those vaults are the attacker’s holding structure. They are not random byproducts of the theft. They are the ledger. Galaxy Research reports that the next ten unmoved vaults contain 30.81 BTC. Ranks 61 through 293—a tail of 233 vaults—hold a combined 33.77 BTC. That asymmetry deserves attention. The top ten remaining victims are worth almost exactly as much as the bottom 233. The distribution is a fat head and a long, thin tail. The attacker knows this. They have already harvested the fat head. This is not the behavior of someone converting stolen value quickly. It is the behavior of someone running an extraction algorithm with a defined priority queue. Largest targets first. Liquidity wherever it can be found. Privacy layers applied only when the size justifies the complexity. The exploit itself began on July 30, 2026, and it reached back years into Coldcard’s history. The entry point was a firmware flaw introduced by a March 2021 update—a build error that no amount of hardware shielding could compensate for. The affected devices began leaning on a weak software random number generator instead of the hardware-based source of entropy. Seed security dropped from the promised 128 bits to as low as 40 bits on older devices. At 40 bits, brute force is not a theoretical attack. It is a weekend project. No physical access was required. No stolen seed phrase. No malicious transaction. The keys were simply too small. This is the part that should make every hardware wallet owner uncomfortable. The device was doing what hardware wallets are supposed to do. It was keeping private keys offline. It was displaying transactions on a secure screen. And yet, somewhere inside that careful architecture, a build error replaced a hardware random number generator with software randomness. Five years later, an attacker noticed. Code is law only until someone finds the loophole. The aftermath was visible on-chain before it was visible in the news. Bitcoin activity jumped sharply. Active addresses climbed to an eight-month high as affected users consolidated their holdings and moved them to safer custody. That spike was not adoption. It was evacuation. The chain recorded a migration event, and journalists who read the chart without reading the context would have called it bullish. Data leaves footprints; hype leaves only dust. The price, meanwhile, did almost nothing. Bitcoin rallied toward $82,000 last month anyway. It has since pulled back to roughly $79,500. In a market where a major hardware wallet exploit once moved sentiment, the incident passed like weather. The active-address spike told the true story: users acted, markets shrugged. But I am more interested in where the stolen coins are going. That is where the forensic picture sharpens. Galaxy Research tracks the movement into two primary channels. Some funds are moving through THORChain to Ethereum. Others are entering CoinJoin rounds. This is a sophisticated laundering stack, but it is not an invisible one. CoinJoin mixes Bitcoin transaction history. THORChain provides cross-chain liquidity without a centralized gatekeeper. Combined, the two offer a path from traceable BTC to something harder to follow. Yet the laundering itself has left a pattern. The first movements on September 2 went through THORChain. The most recent movements are flowing into CoinJoin. Why the switch? Perhaps the attacker is diversifying privacy tools. Perhaps the Ethereum conversion was only an intermediate step. Perhaps the operator is testing which route leaks less metadata. From an investigative standpoint, the route change is a gift. Every transition between tools creates a seam. Seams are where forensic analysts live. The real estate is the vault map. An attacker who consolidates stolen funds into 293 multisig vaults creates a structure that can be monitored. The structure can also be ranked. The ranking is what betrayed the attacker’s next move. Galaxy Research did not just watch funds move. They watched an algorithm execute. This is the difference between transaction monitoring and threat analysis. Transaction monitoring counts what moved. Threat analysis understands why the mover chose that order. The choice to drain ranks one through eleven first tells us the attacker is optimizing for value at risk. That suggests either an entity with withdrawal deadlines or one that is systematically converting the highest-value assets before the network of affected users can coordinate. The 82 percent figure is equally revealing. Across all waves of the exploit, most of the stolen funds remain untouched in the attacker-controlled addresses where they were first deposited. Only 18 percent has moved. The fact that wave 3 alone has seen 45 percent of its value moved while the broader campaign sits mostly frozen suggests a staged exit, possibly a manual one. The latest transactions also exposed something new. Galaxy Research identified a previously unknown vault linked to 58 addresses that are likely associated with Coldcard victims. That vault had not shown up in earlier surveillance. It exists now because the attacker touched it. Every withdrawal is a confession. Every CoinJoin input is a clue. In my own years analyzing on-chain forensics, I have learned that the second transfer is almost always more revealing than the first. The first transfer is the panic move or the strategic seed. The second transfer reflects the infrastructure. An attacker who understands this will split funds early and wait. An attacker who does not will move everything at once and hope the mixers keep up. This attacker clearly understands the geometry of the game. The ranked spending, the delayed exits, the dual-channel laundering—all of it points to a methodical operator who has studied previous exploits as carefully as any analyst has. They are following a playbook, and the playbook appears to be working. But the playbook is also the attacker’s weakest point. Patterns are repeatable. Repeatable behavior is predictable. The moment Galaxy Research could identify 293 vaults and rank them, the campaign became transparent at the structural level. Audits check syntax; journalists check motive. That is the uncomfortable lesson from the Coldcard firmware failure. The original review process in 2021 apparently did not catch a build-level error that silently replaced the hardware entropy source. The crypto industry has spent years obsessing over smart contract reentrancy while the deeper assumption—that the operating system and firmware layer are trustworthy—remains largely unexamined. I remember auditing a Layer-2 bridge in 2022. The code looked clean. The mathematical functions were correct. The vulnerability was in the deployment script. It was not the kind of bug that shows up in a static analysis report of the main contract. It was the kind of bug that shows up only when someone asks how the code is built, not what the code says. The Coldcard flaw is the same species. The wallet’s cryptographic design was sound. Its randomness architecture was sound. But the build pipeline introduced a substitution that undermined both. This is not a failure of cryptography. It is a failure of software supply chain discipline. Now here is where the bulls, or at least the defenders, deserve a hearing. The Coldcard exploit was bad, but it was not the existential threat that hardware wallet critics might want it to be. No malicious firmware update was pushed. No centralized server was compromised. The attack required a generated key from a specific vulnerable window and sufficient visibility into addresses to attempt brute force. That means the attack had scope. It was not a total compromise of all Coldcard users. It was a targeted harvest of devices whose seeds were minted with degraded entropy. That distinction matters. A foundation-level collapse would have shaken Bitcoin’s custody narrative to its core. This was a structural flaw in a specific product line, enabled by a specific error, surviving for years until someone with enough compute and patience came looking. It is a warning, not a death certificate. The market sensed that difference. Bitcoin’s rally to $82,000 was not undermined by the exploit. Active addresses jumped because users moved to clean wallets, but no broader selloff followed. In a strange way, the incident demonstrated the resilience of Bitcoin’s core network while exposing the fragility of its peripheral hardware ecosystem. Still, I cannot write that sentence without a second thought. Bitcoin’s price resilience here is not a sign of health. It is confirmation that the asset now trades on institutional flows that barely register hardware-level security events. Post-ETF, Bitcoin has become Wall Street’s instrument. Satoshi’s peer-to-peer cash vision died somewhere in the custody infrastructure that made the ETF possible. The market’s indifference to the Coldcard exploit is perfectly rational from the perspective of a portfolio manager who has never held a private key. But for the victims, there is no ETF, no basis trade, no delta-neutral hedge. There is only a vault with a reduced seed and an attacker who knows exactly how to open it. What comes next is not a technical question. The firmware flaw can be patched. Devices can be updated. The deeper problem is conceptual. Hardware wallets sell a promise of security that depends on every layer between the chip and the cold storage display being correct. One build error breaks the chain. The industry has no reliable mechanism for verifying that the firmware a user installs is the firmware the developers intended and that the randomness source is the randomness source specified. Truth is not distributed; it is discovered. And discoveries happen only when enough independent parties are watching. As the Coldcard exit continues, I will be watching the queue. The next ten vaults hold 30.81 BTC. Ranks 61 through 293 hold another 33.77. The attacker has demonstrated the discipline to move the largest ranks first. Expect them to continue. Expect the privacy stack to evolve. Expect more previously unknown vaults to surface as the movement reveals them. The question is not whether this operator can be stopped. The address cluster is too large and too behaviorally distinctive to disappear entirely. The question is whether the industry will learn the structural lesson: a wallet is only as cold as its least trustworthy dependency. Firmware is the new supply chain. Build errors are the new reentrancy. And the next time a March update quietly changes where entropy comes from, someone should notice before the evidence shows up as a ranked list of 293 vaults. Will they? The market did not blink. The users migrated. The attacker moved 45 percent of wave 3. And somewhere in a build log from 2021, a single line of code is still waiting for another set of eyes to ask why it was ever allowed to exist.