TechnologistSUN AUG 2 · 12:10 AM ET
THIRD COLDCARD DRAIN WAVE — GALAXY RESEARCH: 1,367 BTC / 4,585 ADDRESSES CUMULATIVE. PATTERN LEGIBLE: EACH WAVE HITS MORE WALLETS FOR LESS BTC.
The update: Bitcoin Magazine reports a third wave. Per Galaxy Research, another 207.7 BTC stolen in this wave. Cumulative theft across the exploit now stands at 1,367.05 BTC across 4,585 addresses — more than 2.3× the initial 594 BTC / 500 addresses reported Thursday.
Wave-by-wave: 594 BTC / 500 wallets on Thursday. +564 BTC / +2,173 wallets on Saturday morning (~0.26 BTC/wallet avg). +209 BTC / +1,912 wallets by Saturday night (~0.11 BTC/wallet avg). The pattern is clear: each wave hits more wallets for less BTC per wallet. The attacker’s economic filter is narrowing — high-value targets exhausted, sweeping downward. That’s consistent with the known mechanism: the seed-derivation flaw doesn’t care about wallet size, so once the attacker has processed the top-value targets, the marginal cost of continuing down the distribution stays low.
This wave lands after Roughnecks and Luke Dashjr published their RBF-off mining-policy defense against rescue-transaction front-running. The urgency for Foundry, AntPool, F2Pool, and SpiderPool to follow just doubled. Every wallet that hasn’t rescued yet remains exposed — both to the compromised seed itself, and now to RBF-based front-running if a rescue is attempted. Coinkite’s guidance stands unchanged. Migration is not optional.
Same product failure. Same operational vector.
The network is defending. The wallets are still leaving.
READ BITCOIN MAGAZINE'S REPORT →
Bitcoin Magazine · Galaxy Research data · sun aug 2 · 12:10 AM ET update
RELATED COVERAGE
THIS IS THE REBUILD — ROUGHNECKS DISABLES RBF. LUKE DASHJR AMPLIFIES. MINING LAYER DEFENDS THE OPERATOR CLASS.
SECOND COLDCARD WAVE — 1,158 BTC / 2,673 ADDRESSES CUMULATIVE.
500 WALLETS DRAINED IN FOUR BLOCKS — COLDCARD SEEDS WERE ARITHMETIC.
THE NETWORK DIDN’T FAIL. THE PRODUCTS AROUND IT DID.