The attacker working by means of Coldcard-generated keys is now emptying wallets price just a few thousand {dollars} every.
Galaxy Analysis flagged a 3rd wave of sweeps early Sunday, roughly 208 bitcoin drained from 1,912 addresses between Friday noon and Saturday morning UTC.
That’s simply over a tenth of a bitcoin per sufferer. The July 30 opening wave averaged shut to a full coin, 1,083 bitcoin from 1,196 addresses in 41 minutes.
Noticed losses throughout all three waves now whole 1,367 bitcoin, practically $89 million, from 4,585 addresses.
Wave three sends every sufferer’s cash to its personal vacation spot reasonably than the handful of shared collector addresses that made the primary two straightforward to map, and parks them in pay-to-witness-script-hash outputs, a format that may carry multisignature or timelock circumstances, as a substitute of the plain single-key outputs used earlier than.
It batched a median of six victims into every sweep the place wave one took precisely one by one, and it scanned solely the default derivation path, the usual department of the important thing tree a pockets checks first, as a substitute of testing a number of branches per seed.
