Galaxy Research tracking shows the Coldcard “Wave 3” attacker continues to move stolen funds, with about 45% of the coins from the incident now transferred. The attacker previously created 293 2-of-2 multisig vaults for victims, first bridging some funds to Ethereum via THORChain on September 2 before recently moving assets into CoinJoin mixing. The attacker has processed vaults ranked 1-11 by value. The next 10 untouched vaults still hold 30.81 BTC, while vaults ranked 61-293 hold a combined 33.77 BTC. A newly linked vault with 58 addresses in the same 2-of-2 multisig format is likely another Coldcard victim, potentially raising the Wave 3 vault count to 294 and total stolen funds to about 1,806 BTC. Overall, about 82% of the BTC stolen in the Coldcard attack remains in the attacker-controlled original addresses, while 18% has been moved for laundering.