The attacker linked to the Coldcard incident has moved Bitcoin worth approximately $7.7 million, according to Decrypt, representing nearly half of the so-called third-wave haul. The funds were distributed across 293 separate vaults created by the attacker. Those vaults are now being emptied according to their balances, beginning with the largest holdings. The activity provides a notable on-chain movement to monitor for Bitcoin market observers, although the supplied information does not identify the destination of the funds or indicate any broader market impact. Decrypt reported the transfers on September 7, 2026. The movement concerns Bitcoin directly; no additional details were provided about the affected wallets, the timing of the original theft, or the identity of the attacker.
