Galaxy Research says the operator behind the third wave of Coldcard seed-generation thefts has moved about 45% of the Bitcoin held in the affected vault cluster. Twelve vaults transferred 97.09 BTC between Sept. 2 and Sept. 7, including the 11 largest-ranked vaults and an additional 6.34 BTC vault that Galaxy considers a likely Coldcard victim cluster. The initial 20.50 BTC exit was swapped through THORChain to two Ethereum addresses, while later transfers entered CoinJoin rounds after passing through Taproot addresses. Galaxy's mapping identifies 293 dedicated 2-of-2 multisignature vaults holding funds from 1,912 victim addresses, while the potentially related additional vault would bring the Wave 3 count to 294. The firm says 282 vaults retain 116.98 BTC and that the operator has been emptying holdings from largest to smallest. Across the wider Coldcard exploit, Galaxy estimates high-confidence losses near 1,789 BTC and $115 million as of Sept. 3, with the extra vault potentially raising its published total to about 1,806 BTC. About 82% of Bitcoin attributed to the overall exploit remains in original attacker-controlled addresses, while 18% has moved in what Galaxy described as apparent laundering.