The attacker working via Coldcard-generated keys is now emptying wallets price just a few thousand {dollars} every.
Galaxy Analysis flagged a 3rd wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday noon and Saturday morning UTC.
That’s simply over a tenth of a bitcoin per sufferer. The July 30 opening wave averaged near a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes.
Noticed losses throughout all three waves now complete 1,367 bitcoin, practically $89 million, from 4,585 addresses.
Wave three sends every sufferer’s cash to its personal vacation spot reasonably than the handful of shared collector addresses that made the primary two straightforward to map, and parks them in pay-to-witness-script-hash outputs, a format that may carry multisignature or timelock circumstances, as an alternative of the plain single-key outputs used earlier than.
It batched a mean of six victims into every sweep the place wave one took precisely one by one, and it scanned solely the default derivation path, the usual department of the important thing tree a pockets checks first, as an alternative of testing a number of branches per seed.
