Unchained · Tuesday, August 4, 2026
Alex Thorne, an expert in on-chain forensic tracing, has identified at least three distinct waves of the Coldcard hack, with a potential fourth wave emerging. Thorne detailed that Wave 1 and 2 involved bulk transfers to collector addresses, while Wave 3 used a different topography with one victim per vault. The difficulty in tracing lies in the thousands of previously unconnected Coldcard addresses.
“We also have an expert who's been commenting on it extensively here, Alex Thorne, who, Alex, I saw on Coin Telegram, you said a fourth organized wave is likely in progress, 208 transactions across some specific blocks, sweeping about 389 Bitcoin from 462 suspected victim addresses in roughly 2.5 hours.”
“I've got three defined waves we could call it Wave 1, Wave 2, Wave 3, any prospective Wave 4, which is still sort of in the medium to high confidence, I haven't actually promoted into what I'm considering a high confidence part of the attack.”
“Wave 3 has a totally different topography, an internally consistent one. So we think each of these waves one, two and three, we're confident, are waves.”