The operator behind the third wave of Coldcard seed-generation thefts has moved 97.09 BTC, worth about $7.8 million, or roughly 45% of the assets stolen in that attack. Galaxy Research said the activity included a Sept. 2 conversion of Bitcoin into Ethereum through THORChain and a Sept. 6 transfer through CoinJoin. The attacker has moved funds from the 11 largest wallets first, while the next 10 untouched wallets hold 30.81 BTC and wallets ranked 61 through 293 hold 33.77 BTC. Galaxy estimates that about 82% of Bitcoin stolen across the wider Coldcard exploit remains at the attackers' original receiving addresses, with 18% moved in activity linked to laundering or asset conversion. Its estimate of roughly 1,779 BTC stolen from about 190 victims and more than 8,600 addresses rose to 1,806 BTC, worth about $143.9 million, after the firm linked a previously unknown vault containing 58 addresses to the exploit. The thefts exploited weak randomness in Coldcard firmware distributed in 2021, allowing private seed phrases for affected single-signature wallets to be brute-forced offline. Despite increased on-chain activity as users shifted funds, Bitcoin's price impact has been limited.