COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

COLDCARD hack tracker

coldcard-hack-tracker

https://coldcard-hack-tracker.vercel.app/

Latest reviewed change

source content difference between and

The tracker added a new Hop 1 movement of 0.241352 BTC from the Aug 1 hop vault at block 960,658.

seen +8 -0 full history below 
 Block 960,658
 
 To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc

First lines only. The complete diff is in the timeline below.

Organisation
community tracker
Evidence role
Chain monitor
Published
continuously updated
Source changes
116
Detected differences
140
Unreviewed
0
Copies held
141

Second, independent tracker of the same four holding addresses. States the accounting precision the reporting rounded: 1,082.65 BTC drained, 1,082.57 BTC arrived, the difference paid to miners as fees. Cites Galaxy, Coinkite and Block. The page is client-rendered. The empty shell from the first capture is preserved as a capture correction, followed by complete rendered captures.

The operator rebuilt the page on 2 August 2026 around a five-wave model, which renamed the section heading this capture previously keyed on. The guard string moved from that heading to "Watched holdings"; "Holding 1" and "Movement feed" are retained because they appear only after the client-side data resolves, so an unrendered shell still fails the check rather than entering the record.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. source content difference between and Current source content +8 -0

    The tracker added a new Hop 1 movement of 0.241352 BTC from the Aug 1 hop vault at block 960,658.

    seen · Captured here 29,987 chars
    What changed from the previous capture 8 lines 
     Block 960,658
 
 To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,059,433

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,127,917
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,792,520
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  2. source content difference between and source content +0 -8

    The tracker removed the Holding 1 HOP 1 movement entry showing 0.241352 BTC sent from the Aug 1 hop vault in block 960,658.

    seen · Captured here 29,872 chars
    What changed from the previous capture 8 lines 
     Block 960,658
 
 To bc1qsd9t…jah8, bc1qvrpc…cddc
-
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,194,100

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,203,702
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,797,852
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  3. source content difference between and source content +17 -6

    The tracker updated its Galaxy attribution to the Aug 14 $112M update, raising high-confidence losses from 1,719 to 1,778.84 BTC, adding a new Aug 2 vault movement of about 64.9 BTC, and noting no confirmed attack after Aug 6.

    seen · Captured here 29,987 chars
    What changed from the previous capture 23 lines 
    -LIVE CHAIN MONITOR
-
 Coldcard Hack Tracker
 
 Seed-entropy sweeps since July 2026
 
 Watched holdings
 
-About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 7 high-confidence headline is 1,719.00 BTC across 8,092 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,300.00 BTC if outstanding candidates are promoted. 1,485.7757442 BTC is in watched holdings. The remaining ~438.03173705 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now tracks 25+ attack patterns.
+About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 14 high-confidence headline is 1,778.84 BTC across more than 8,600 addresses (Waves 1–3 + owner-confirmed footprints), or up to 2,417.35 BTC if outstanding candidates are promoted. 1,485.7757442 BTC is in watched holdings. The remaining ~438.03173705 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now tracks 33+ footprints beyond Waves 1–3. No confirmed attack after Aug 6.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LIKELY WAVE 4 · AUG 3
 Source
 
-Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Galaxy’s Aug 7 candidate ceiling is 2,300+ BTC (high-confidence 1,719 plus outstanding promotions, including this Wave 4 figure) — not our stricter 443.34 cut. Watched addresses are a sparse still-held sample.
+Pattern-match only (no victim report yet). Galaxy’s Aug 7 Wave 4 figure was 448.73 BTC after cutting 89 multisig destinations; their Aug 14 unpublished Wave 4 band is 622.58. We go one step further than the Aug 7 cut and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our watched total is 443.34. Galaxy’s Aug 14 candidate ceiling is 2,417.35 BTC (high-confidence 1,778.84 plus unpublished promotions) — not our stricter 443.34 cut. Watched addresses are a sparse still-held sample.
 
 SCOPE
 443.34 BTC · 703 addrs
 Block 961,076
 
 To bc1qh6me…z56m
+
+e3274a1b…2b3ddf
+−64.90373764 BTC
+From Aug 2 vault bc1q0rvn…5q6m
+Block 961,065
+
+To bc1pynd6…7h92
 
 f02164a9…0db281
 −2.17767618 BTC
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
+Galaxy Research · $112M update
+
+Aug 14: high-confidence 1,778.84 BTC / 8,600+ addresses (~$112.7M) from 190 victims spoken to; tweet rounds to 1,778 BTC / $112M. No confirmed attack after Aug 6. Three waves + ≥33 footprints; multiple attackers. 1,531 BTC still unmoved; ~246 moved (≈65% coinjoin / ≈35% onward). Medium-confidence + unconfirmed Wave 4 → 2,417.35 BTC ($153M). Attacker-address lists shared with exchanges, compliance, and law enforcement. Brief / Thorn.
+
 Galaxy Research · $111M update
 
-Aug 7: high-confidence 1,719 BTC / 8,092 addresses (~$111M); chart established losses 1,719.19. Outstanding candidates → 2,300+ BTC if promoted; total losses likely exceed $130M. 25+ attack patterns / multiple threat actors. Scope still Coldcard Mk3/Mk4/Mk5/Q post–2021-03-17 firmware. 250+ victim reports via @intangiblecoins.
+Aug 7: high-confidence 1,719 BTC / 8,092 addresses (~$111M); chart established losses 1,719.19. Outstanding candidates → 2,300+ BTC if promoted; total losses likely exceed $130M. 25+ attack patterns / multiple threat actors. Scope still Coldcard Mk3/Mk4/Mk5/Q post–2021-03-17 firmware. 250+ victim reports via @intangiblecoins. Superseded by the Aug 14 $112M cut.
 
 Galaxy Research · $100M update
 
-Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins then still unmoved (Wave 2 collector later emptied Aug 7). Superseded by the Aug 7 $111M cut.
+Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins then still unmoved (Wave 2 collector later emptied Aug 7). Superseded by later Galaxy cuts.
 
 Alex Thorn · Footprint O
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
 Not affiliated with Coinkite or Coldcard.
+
+Balances from the ~6h snapshot · last updated <relative-time>.
    Extracted text as captured 
    Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,084,443

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,141,991
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,793,510
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  4. source content difference between and source content +0 -7

    The movement feed removed the Aug 2 vault entry that had reported -64.90373764 BTC moved in block 961,065 to bc1pynd6...7h92.

    seen · Captured here 29,237 chars
    What changed from the previous capture 7 lines 
     Block 961,076
 
 To bc1qh6me…z56m
-
-e3274a1b…2b3ddf
-−64.90373764 BTC
-From Aug 2 vault bc1q0rvn…5q6m
-Block 961,065
-
-To bc1pynd6…7h92
 
 f02164a9…0db281
 −2.17767618 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,015,186

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,103,016
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,790,769
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  5. source content difference between and source content +4 -0

    The tracker added a Wave 1 forensics section attributed to Praveen Perera, reporting that 328 weak Mk3 seeds were reconstructed covering 1,042 of 1,195 Wave 1 sources (949.7 BTC), with 153 sources (~133 BTC) still unexplained.

    seen · Captured here 29,335 chars
    What changed from the previous capture 4 lines 
     
 Aug 12: reproduces the Mk3 4.1.9 attack chain (Yasmarang fallback, button-press profiles, GPU pad search) and MistTrack consolidations aligned with Galaxy W1–3 / Early Aug 2 / P2TR cash-outs. Uses Galaxy’s 1,719 BTC headline; their “Wave 4” label for bc1q0rvn88… is our Early Aug 2 vault, not Thorn’s Likely Wave 4.
 
+Praveen Perera · Wave 1 forensics
+
+Aug 12–13: reconstructs 328 weak Mk3 seeds covering 1,042 / 1,195 Wave 1 sources (949.7 BTC); maps Holding 1–4 into three scan-session branches; same 30 sat/vB address-job builder + paid-API clues; 153 sources (~133 BTC) still unexplained.
+
 Nunchuk · Slipstream migration
 
 Aug 3: multisig urgency tiers (Coldcard keys alone vs below threshold) and MARA Slipstream to avoid RBF-sniping during migration; Slipstream now public with no code.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,055,966

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,688,729
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,831,971
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  6. source content difference between and source content +11 -3

    The movement feed advanced from block 962,196 to block 962,295 and recorded a new 5.35785418 BTC hop-2 movement from the Wave 4 park vault, splitting onward to two bech32 destinations.

    seen · Captured here 29,059 chars
    What changed from the previous capture 14 lines 
     
 LAST MOVEMENT
 
-Block 962,196
-
-0.01573188 BTC from Hop 1 from Wave 4 park
+Block 962,295
+
+5.35785418 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+HOP 2
+f5d48ba4…0f7131
+−5.35785418 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qy4ez…uh9z
+Block 962,295
+
+To bc1qq4xu…76sf, bc1qng98…hfte
 
 HOP 1
 d52c27a3…53e555
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,771,242

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,528,497
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,820,700
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  7. source content difference between and source content +2 -2

    The tracker updated its CK tripwire honeypot notes to reflect a second low-pass honeypot sweep on August 13 and maintained the approximately 11-bit frontier figure.

    seen · Captured here 28,909 chars
    What changed from the previous capture 4 lines 
     BEYOND THE MAIN SEED
 Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase; ColeTU saw 1–3 BIP39-word passphrases on a compromised Mk3 seed swept in ~6–7 days. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; frontier ~11 bits by Aug 12 after a low/pass honeypot sweep; mid/high bands still live). Still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase; ColeTU saw 1–3 BIP39-word passphrases on a compromised Mk3 seed swept in ~6–7 days. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; frontier still ~11 bits as of Aug 13 after two low/pass honeypot sweeps; mid/high bands still live). Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 
 James O'Beirne · CK tripwire
 
-Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h. By Aug 8, multiple ~5-bit low (dice) honeypots were swept (jamesob). By Aug 12, frontier ~11 bits after a low (pass) honeypot (HP-9C4F) was swept; mid/high/extreme bands still live. ColeTU’s weak BIP-39 passphrase experiment is listed as an external honeypot (1–3 word Mk3 passphrases swept in ~6–7d; claimed Mk4 seed still live). Defensive research only — do not add honeypot sinks to holdings.
+Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h. By Aug 8, multiple ~5-bit low (dice) honeypots were swept (jamesob). Frontier still ~11 bits after a second low (pass) honeypot (HP-E786) was swept Aug 13, following HP-9C4F on Aug 12; mid/high/extreme bands still live. ColeTU’s weak BIP-39 passphrase experiment is listed as an external honeypot (1–3 word Mk3 passphrases swept in ~6–7d; claimed Mk4 seed still live). Defensive research only — do not add honeypot sinks to holdings.
 
 Galaxy Research · Wave 3
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,404,175

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,884,689
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,845,756
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  8. source content difference between and source content +11 -3

    The movement feed recorded a new Wave 4 park hop-1 spend of 0.01573188 BTC at block 962,196, replacing the previous last-movement entry at block 961,731.

    seen · Captured here 28,859 chars
    What changed from the previous capture 14 lines 
     
 LAST MOVEMENT
 
-Block 961,731
-
-0.0077407 BTC from Hop 1 from Wave 4 park
+Block 962,196
+
+0.01573188 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+HOP 1
+d52c27a3…53e555
+−0.01573188 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 962,196
+
+To bc1qy4ez…uh9z
 
 HOP 1
 a2e65c44…7596bd
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,982,861

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,647,589
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,829,077
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  9. source content difference between and source content +6 -2

    The tracker added ColeTU's weak-passphrase experiment to its guidance and honeypot scoreboard, raised the observed brute-force frontier to about 11 bits, and added a SlowMist Aug. 12 section reproducing the Mk3 4.1.9 attack chain and reconciling its Wave 4 label with the tracker's Early Aug 2 vault.

    seen · Captured here 28,745 chars
    What changed from the previous capture 8 lines 
     BEYOND THE MAIN SEED
 Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; ~5-bit low/dice honeypots swept by Aug 8; mid/high bands still live). Still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase; ColeTU saw 1–3 BIP39-word passphrases on a compromised Mk3 seed swept in ~6–7 days. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; frontier ~11 bits by Aug 12 after a low/pass honeypot sweep; mid/high bands still live). Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 
 James O'Beirne · CK tripwire
 
-Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h. By Aug 8, multiple ~5-bit low (dice) honeypots were swept (jamesob); frontier still ~5 bits with mid/high passphrase bands live. Defensive research only — do not add honeypot sinks to holdings.
+Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h. By Aug 8, multiple ~5-bit low (dice) honeypots were swept (jamesob). By Aug 12, frontier ~11 bits after a low (pass) honeypot (HP-9C4F) was swept; mid/high/extreme bands still live. ColeTU’s weak BIP-39 passphrase experiment is listed as an external honeypot (1–3 word Mk3 passphrases swept in ~6–7d; claimed Mk4 seed still live). Defensive research only — do not add honeypot sinks to holdings.
 
 Galaxy Research · Wave 3
 
 
 Aug 1 deep dive: who is affected (including Mk3 5.0.x), advanced features still broken with dice seeds, and migration guidance.
 
+SlowMist
+
+Aug 12: reproduces the Mk3 4.1.9 attack chain (Yasmarang fallback, button-press profiles, GPU pad search) and MistTrack consolidations aligned with Galaxy W1–3 / Early Aug 2 / P2TR cash-outs. Uses Galaxy’s 1,719 BTC headline; their “Wave 4” label for bc1q0rvn88… is our Early Aug 2 vault, not Thorn’s Likely Wave 4.
+
 Nunchuk · Slipstream migration
 
 Aug 3: multisig urgency tiers (Coldcard keys alone vs below threshold) and MARA Slipstream to avoid RBF-sniping during migration; Slipstream now public with no code.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,023,261

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,670,324
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,830,676
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  10. source content difference between and source content +6 -22

    The tracker updated its watched balances and UTXO counts, removed some hop entries from the movement feed, and relabeled a destination as a Quidax deposit.

    seen · Captured here 28,113 chars
    What changed from the previous capture 28 lines 
     
 BALANCE ON WATCH
 
-1,367.16828024 BTC
+1,367.1683017 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60746396 BTC
+118.6074425 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02141094 BTC
-<live-fiat-value>
-	562.02021083 BTC	58	HELD
+	bc1qq85v2c…3fcu9r	562.0214324 BTC
+<live-fiat-value>
+	562.02021083 BTC	60	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 
 To bc1q55ll…g4q2
 
-HOP 2
-e5530973…acbf62
-−0.00010224 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
-Block 961,384
-
-To bc1qcgjn…tdt7
-
 93df0d26…4eabd4
 −30.18476329 BTC
 From Wave 2 collector bc1qmd5m…8jp6
 Block 961,368
 
 To bc1qez89…dt6n
-
-HOP 2
-d05a5ac8…ac4abe
-−0.00031259 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
-Block 961,148
-
-To bc1qcgjn…tdt7
 
 HOP 1
 24ee02cf…7d11f2
 From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
 Block 960,898
 
-To bc1qcgjn…tdt7
+To Quidax deposit bc1qcgjn…tdt7
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,419,565

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,893,350
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,846,365
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  11. source content difference between and source content +8 -0

    The movement feed added a new Hop 1 spend of 0.02374887 BTC from the Wave 4 park vault at block 960,794 to bc1qhfdz...3wcx.

    seen · Captured here 28,351 chars
    What changed from the previous capture 8 lines 
     Block 960,898
 
 To bc1qcgjn…tdt7
+
+HOP 1
+6c85668e…d30bbb
+−0.02374887 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,741,981

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,763,087
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,977,894
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  12. source content difference between and source content +5 -13

    The tracker raised its total watched balance from 1,367.16826524 BTC to 1,367.16828024 BTC, the bc1qq85v2c holding balance rose from 562.02139594 BTC to 562.02141094 BTC, and its HELD count moved from 57 to 58. The movement feed also lost the HOP 1 entry from Wave 4.

    seen · Captured here 28,238 chars
    What changed from the previous capture 18 lines 
     
 BALANCE ON WATCH
 
-1,367.16826524 BTC
+1,367.16828024 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60747896 BTC
+118.60746396 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02139594 BTC
-<live-fiat-value>
-	562.02021083 BTC	57	HELD
+	bc1qq85v2c…3fcu9r	562.02141094 BTC
+<live-fiat-value>
+	562.02021083 BTC	58	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 Block 960,898
 
 To bc1qcgjn…tdt7
-
-HOP 1
-6c85668e…d30bbb
-−0.02374887 BTC
-From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,216,781

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,467,523
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,957,102
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  13. source content difference between and source content +5 -5

    The tracker raised its total watched balance from 1,367.16824986 BTC to 1,367.16826524 BTC, and the bc1qq85v2c holding balance rose from 562.02138056 BTC to 562.02139594 BTC while its HELD count moved from 56 to 57. The movement-feed total changed in the same capture.

    seen · Captured here 28,351 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,367.16824986 BTC
+1,367.16826524 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60749434 BTC
+118.60747896 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02138056 BTC
-<live-fiat-value>
-	562.02021083 BTC	56	HELD
+	bc1qq85v2c…3fcu9r	562.02139594 BTC
+<live-fiat-value>
+	562.02021083 BTC	57	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,109,048

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,406,895
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,952,837
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  14. source content difference between and source content +3 -27

    The tracker relabeled one destination as a Bybit deposit and removed several older Wave 4 park hop entries from the movement feed. It also updated its dice/passphrase honeypot notes to report that ~5-bit low/dice honeypots were swept by Aug 8, with mid/high passphrase bands still live.

    seen · Captured here 28,351 chars
    What changed from the previous capture 30 lines 
     From Hop 1 from Wave 4 park bc1q72k7…aamt
 Block 961,731
 
-To 17fqFGPG…FcFL
+To Bybit deposit 17fqFGPG…FcFL
 
 HOP 1
 da5064ee…21977f
 Block 960,898
 
 To bc1qcgjn…tdt7
-
-HOP 2
-822230d2…e3083a
-−0.47797906 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
-Block 960,832
-
-To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
-
-HOP 1
-15d1287d…e9bdf0
-−0.50633044 BTC
-From Hop 1 from Wave 4 park bc1qa2xv…c3y9
-Block 960,822
-
-To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
-
-HOP 2
-24ed08ad…a7f583
-−4.27762101 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
-Block 960,797
-
-To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
 
 HOP 1
 6c85668e…d30bbb
 BEYOND THE MAIN SEED
 Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; low-band honeypots still live as of Aug 4). Still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; ~5-bit low/dice honeypots swept by Aug 8; mid/high bands still live). Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 
 James O'Beirne · CK tripwire
 
-Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h; low-band (11–13 bit) honeypots still live at launch. Defensive research only — do not add honeypot sinks to holdings.
+Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h. By Aug 8, multiple ~5-bit low (dice) honeypots were swept (jamesob); frontier still ~5 bits with mid/high passphrase bands live. Defensive research only — do not add honeypot sinks to holdings.
 
 Galaxy Research · Wave 3
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,359,143

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,547,639
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,962,738
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  15. source content difference between and source content +19 -3

    The movement feed updated from block 961,598 to block 961,731 and added new Hop 1 and Hop 2 spends, including a 0.0077407 BTC movement from the Wave 4 park vault and a 0.00308496 BTC onward spend.

    seen · Captured here 28,732 chars
    What changed from the previous capture 22 lines 
     
 LAST MOVEMENT
 
-Block 961,598
-
-0.00768211 BTC from Hop 1 from Wave 4 park
+Block 961,731
+
+0.0077407 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+HOP 1
+a2e65c44…7596bd
+−0.0077407 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,731
+
+To 17fqFGPG…FcFL
+
+HOP 1
+da5064ee…21977f
+−0.00308496 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,730
+
+To bc1q55ll…g4q2
 
 HOP 1
 cd1d5683…a3fa2b
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,241,791

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,481,598
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,958,092
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  16. source content difference between and source content +7 -0

    The movement feed added a new −0.50980268 BTC spend from the Evening vault at block 960,666.

    seen · Captured here 28,508 chars
    What changed from the previous capture 7 lines 
     Block 960,668
 
 To bc1qprkj…jr98
+
+ff327937…abc133
+−0.50980268 BTC
+From Evening vault bc1q7rms…rcgf
+Block 960,666
+
+To bc1qu2uq…6srw
 
 HOP 2
 3cf126ca…10ae88
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,926,286

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,304,043
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,945,602
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  17. source content difference between and source content +0 -7

    The movement feed removed a -0.50980268 BTC entry from the Evening vault.

    seen · Captured here 28,410 chars
    What changed from the previous capture 7 lines 
     Block 960,668
 
 To bc1qprkj…jr98
-
-ff327937…abc133
-−0.50980268 BTC
-From Evening vault bc1q7rms…rcgf
-Block 960,666
-
-To bc1qu2uq…6srw
 
 HOP 2
 3cf126ca…10ae88
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,747,372

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,203,357
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,938,519
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  18. source content difference between and source content +8 -0

    The movement feed reintroduced the Wave 4 park hop-1 entry that the preceding capture had removed.

    seen · Captured here 28,508 chars
    What changed from the previous capture 8 lines 
     Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
+HOP 1
+6c85668e…d30bbb
+−0.02374887 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,783,925

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,223,927
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,939,966
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  19. source content difference between and source content +7 -8

    The movement feed removed the Wave 4 park hop-1 entry and added a new −64.90373764 BTC movement from the Aug 2 vault at block 961,065.

    seen · Captured here 28,395 chars
    What changed from the previous capture 15 lines 
     
 To bc1qh6me…z56m
 
+e3274a1b…2b3ddf
+−64.90373764 BTC
+From Aug 2 vault bc1q0rvn…5q6m
+Block 961,065
+
+To bc1pynd6…7h92
+
 f02164a9…0db281
 −2.17767618 BTC
 From Wave 4 park 35dHFzKH…wNxH
 Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
-
-HOP 1
-6c85668e…d30bbb
-−0.02374887 BTC
-From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,637,715

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,141,646
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,934,178
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  20. source content difference between and source content +0 -7

    The movement feed dropped a 64.9037 BTC line item that had moved from the Aug 2 vault to bc1pynd6...7h92 in block 961,065.

    seen · Captured here 28,411 chars
    What changed from the previous capture 7 lines 
     Block 961,076
 
 To bc1qh6me…z56m
-
-e3274a1b…2b3ddf
-−64.90373764 BTC
-From Aug 2 vault bc1q0rvn…5q6m
-Block 961,065
-
-To bc1pynd6…7h92
 
 f02164a9…0db281
 −2.17767618 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,660,801

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,154,637
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,935,092
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  21. source content difference between and source content +5 -5

    The tracker updated several watched balances and Holding 1's UTXO count rose from 55 to 56 while its held status remained unchanged.

    seen · Captured here 28,508 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,367.16823448 BTC
+1,367.16824986 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60750972 BTC
+118.60749434 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02136518 BTC
-<live-fiat-value>
-	562.02021083 BTC	55	HELD
+	bc1qq85v2c…3fcu9r	562.02138056 BTC
+<live-fiat-value>
+	562.02021083 BTC	56	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,889,734

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,283,473
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,944,155
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  22. source content difference between and source content +5 -5

    The watched total changed from 1,367.16822948 to 1,367.16823448 BTC, one holding balance shifted by 0.00000500 BTC, and Holding 1's UTXO count increased from 54 to 55.

    seen · Captured here 28,508 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,367.16822948 BTC
+1,367.16823448 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60751472 BTC
+118.60750972 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02136018 BTC
-<live-fiat-value>
-	562.02021083 BTC	54	HELD
+	bc1qq85v2c…3fcu9r	562.02136518 BTC
+<live-fiat-value>
+	562.02021083 BTC	55	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,043,639

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,370,085
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,950,248
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  23. source content difference between and source content +11 -3

    The movement feed added a new 0.00768211 BTC Hop 1 spend from Wave 4 park in block 961,598, replacing the earlier block 961,543 entry.

    seen · Captured here 28,508 chars
    What changed from the previous capture 14 lines 
     
 LAST MOVEMENT
 
-Block 961,543
-
-0.00462205 BTC from Hop 1 from Wave 4 park
+Block 961,598
+
+0.00768211 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+HOP 1
+cd1d5683…a3fa2b
+−0.00768211 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,598
+
+To bc1q55ll…g4q2
 
 HOP 1
 18f7ec31…9d561f
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,101,353

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,402,564
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,952,532
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  24. source content difference between and source content +0 -8

    The tracker dropped the -0.02374887 BTC Hop 1 entry from the movement feed, leaving only the second input for the same transaction.

    seen · Captured here 28,282 chars
    What changed from the previous capture 8 lines 
     Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
-
-HOP 1
-6c85668e…d30bbb
-−0.02374887 BTC
-From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,024,401

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,359,258
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,949,486
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  25. source content difference between and source content +16 -8

    A new Wave 4 park movement of 0.00462205 BTC arrived in block 961,543, raising BALANCE ON WATCH to 1,367.16822948 BTC, lowering MOVED to 118.60751472 BTC, and increasing the HELD count to 54.

    seen · Captured here 28,395 chars
    What changed from the previous capture 24 lines 
     
 BALANCE ON WATCH
 
-1,367.16819948 BTC
+1,367.16822948 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60754472 BTC
+118.60751472 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,428
-
-0.00046352 BTC from Hop 1 from Wave 4 park
+Block 961,543
+
+0.00462205 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02133018 BTC
-<live-fiat-value>
-	562.02021083 BTC	53	HELD
+	bc1qq85v2c…3fcu9r	562.02136018 BTC
+<live-fiat-value>
+	562.02021083 BTC	54	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+HOP 1
+18f7ec31…9d561f
+−0.00462205 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,543
+
+To bc1q55ll…g4q2
 
 HOP 1
 a2378c07…1b842f
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,995,543

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,343,018
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,948,344
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  26. source content difference between and source content +5 -5

    Dust-sized movement only: BALANCE ON WATCH rose by 0.000005 BTC to 1,367.16819948 and MOVED fell by the same amount to 118.60754472, with the holding-address balances adjusting to match. No new movement-feed entry and no change to STILL HELD.

    seen · Captured here 28,282 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,367.16819448 BTC
+1,367.16819948 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60754972 BTC
+118.60754472 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02132518 BTC
-<live-fiat-value>
-	562.02021083 BTC	52	HELD
+	bc1qq85v2c…3fcu9r	562.02133018 BTC
+<live-fiat-value>
+	562.02021083 BTC	53	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,851,258

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,261,820
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,942,632
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  27. source content difference between and source content +7 -0

    The movement feed gained a row for a 64.90373764 BTC spend out of the Aug 2 vault bc1q0rvn…5q6m at block 961,065, to bc1pynd6…7h92. The block is older than rows the feed already carried, so the tracker backfilled an earlier movement into its feed rather than observing one live. Headline MOVED and STILL HELD are unchanged at 118.6075 BTC and 92.0 percent apart from dust.

    seen · Captured here 28,282 chars
    What changed from the previous capture 7 lines 
     Block 961,076
 
 To bc1qh6me…z56m
+
+e3274a1b…2b3ddf
+−64.90373764 BTC
+From Aug 2 vault bc1q0rvn…5q6m
+Block 961,065
+
+To bc1pynd6…7h92
 
 f02164a9…0db281
 −2.17767618 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,951,296

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,318,118
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,946,592
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  28. source content difference between and source content +8 -15

    The tracker updated several holding balances and UTXO counts, including Holding 1 and Holding 2, and removed a prior movement feed entry for the evening vault.

    seen · Captured here 28,185 chars
    What changed from the previous capture 23 lines 
     
 BALANCE ON WATCH
 
-1,367.16816351 BTC
+1,367.16819448 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60758069 BTC
+118.60754972 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.0213098 BTC
-<live-fiat-value>
-	562.02021083 BTC	51	HELD
+	bc1qq85v2c…3fcu9r	562.02132518 BTC
+<live-fiat-value>
+	562.02021083 BTC	52	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.45058754 BTC
-<live-fiat-value>
-	32.4505632 BTC	163	HELD
+	bc1qnk4zh9…8fecp0	32.45060313 BTC
+<live-fiat-value>
+	32.4505632 BTC	164	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
 Block 961,076
 
 To bc1qh6me…z56m
-
-e3274a1b…2b3ddf
-−64.90373764 BTC
-From Aug 2 vault bc1q0rvn…5q6m
-Block 961,065
-
-To bc1pynd6…7h92
 
 f02164a9…0db281
 −2.17767618 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,955,144

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,320,283
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,946,744
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  29. source content difference between and source content +8 -4

    The tracker updated its Galaxy attribution to the Aug 7 $111M update: high-confidence losses rose from 1,596 BTC across about 7,300 addresses to 1,719 BTC across 8,092 addresses, the candidate ceiling rose from about 2,055 BTC to 2,300+ BTC, and the attacker count estimate changed from at least 15 to 25 plus attack patterns. Footprint O is now noted as folded into Galaxy's Aug 7 confirmed footprint set.

    seen · Captured here 28,282 chars
    What changed from the previous capture 12 lines 
     
 Watched holdings
 
-About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 3 high-confidence headline is 1,596.00 BTC across ~7,300 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,055.00 BTC if candidate Wave 4 is included. 1,485.7757442 BTC is in watched holdings. The remaining ~438.03173705 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now estimates ≥15 attackers.
+About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 7 high-confidence headline is 1,719.00 BTC across 8,092 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,300.00 BTC if outstanding candidates are promoted. 1,485.7757442 BTC is in watched holdings. The remaining ~438.03173705 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now tracks 25+ attack patterns.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LIKELY WAVE 4 · AUG 3
 Source
 
-Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Galaxy’s Aug 3 ceiling ~2,055 BTC is their high-confidence 1,596 plus this 448.73 candidate — not our stricter 443.34 cut. Watched addresses are a sparse still-held sample.
+Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Galaxy’s Aug 7 candidate ceiling is 2,300+ BTC (high-confidence 1,719 plus outstanding promotions, including this Wave 4 figure) — not our stricter 443.34 cut. Watched addresses are a sparse still-held sample.
 
 SCOPE
 443.34 BTC · 703 addrs
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
+Galaxy Research · $111M update
+
+Aug 7: high-confidence 1,719 BTC / 8,092 addresses (~$111M); chart established losses 1,719.19. Outstanding candidates → 2,300+ BTC if promoted; total losses likely exceed $130M. 25+ attack patterns / multiple threat actors. Scope still Coldcard Mk3/Mk4/Mk5/Q post–2021-03-17 firmware. 250+ victim reports via @intangiblecoins.
+
 Galaxy Research · $100M update
 
-Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins then still unmoved (Wave 2 collector later emptied Aug 7).
+Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins then still unmoved (Wave 2 collector later emptied Aug 7). Superseded by the Aug 7 $111M cut.
 
 Alex Thorn · Footprint O
 
-Aug 4: ≥15 attackers (footprints A–O). Overnight footprint O ~12 BTC from 126 addresses from one victim report; no public address list yet.
+Aug 4: ≥15 attackers (footprints A–O). Overnight footprint O ~12 BTC from 126 addresses from one victim report; later folded into Galaxy’s Aug 7 confirmed footprint set (no public address list).
 
 James O'Beirne · CK tripwire
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,803,163

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,234,753
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,940,728
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  30. source content difference between and source content +3 -3

    Tracker prose updated for the Wave 2 collector emptying: the collector entry now says it was emptied Aug 7 (block 961368) into a hop still holding ~30.18 BTC, and the Galaxy Research source note is qualified to say Waves 1-3 coins were unmoved as of Aug 3.

    seen · Captured here 27,785 chars
    What changed from the previous capture 6 lines 
     GALAXY WAVE 2 · JULY 31
 Source
 
-Two fee bands into a watched vault plus an unmoved collector.
+Two fee bands into a watched vault plus a collector; collector emptied Aug 7 into a hop still holding ~30.18 BTC.
 
 SCOPE
 76.16 BTC · 1,478 addresses
 	45.90251994 BTC	4	HELD
 
 Wave 2 collector
-Unmoved collector from 93 sweeps at ~10 sat/vB. Chainabuse victim.
+Collector from 93 sweeps at ~10 sat/vB. Emptied Aug 7 (block 961368, ~2.4 sat/vB): 93-input consolidate → bc1qez89… still holding ~30.18 BTC (93df0d26…abd4). Dust leftover (~0.00002 BTC). Chainabuse victim.
 	bc1qmd5m5k…9n8jp6	0.00002 BTC
 <live-fiat-value>
 	30.18476329 BTC	2	PARTIAL
 SOURCES
 Galaxy Research · $100M update
 
-Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins still unmoved.
+Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins then still unmoved (Wave 2 collector later emptied Aug 7).
 
 Alex Thorn · Footprint O
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,413,010

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,577,954
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,964,870
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  31. source content difference between and source content +11 -4

    The 0.00046352 BTC hop spend confirmed at block 961,428 and LAST MOVEMENT updated to it. The two f02164a9 consolidation rows dropped in the previous capture are back.

    seen · Captured here 27,549 chars
    What changed from the previous capture 15 lines 
     
 LAST MOVEMENT
 
-Block 961,404
-
-0.02324129 BTC from Hop 1 from Wave 4 park
+Block 961,428
+
+0.00046352 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 a2378c07…1b842f
 −0.00046352 BTC
 From Hop 1 from Wave 4 park bc1q72k7…aamt
-Unconfirmed
+Block 961,428
 
 To bc1qkc7l…qc58
 
 f02164a9…0db281
 −1.09429601 BTC
 From Wave 4 park 36XfMDAY…1x3G
+Block 961,064
+
+To 334iKwmh…J6gB
+
+f02164a9…0db281
+−0.96227191 BTC
+From Wave 4 park 34nHYNnc…4qDQ
 Block 961,064
 
 To 334iKwmh…J6gB
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$125,005,163

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,348,432
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,948,724
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  32. source content difference between and source content +8 -7

    New unconfirmed hop-1 spend of 0.00046352 BTC from the Wave 4 park hop added to the movement feed. Two feed rows for the f02164a9 consolidation were temporarily dropped; they return in the next capture.

    seen · Captured here 27,451 chars
    What changed from the previous capture 15 lines 
     Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
 
 HOP 1
+a2378c07…1b842f
+−0.00046352 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Unconfirmed
+
+To bc1qkc7l…qc58
+
+HOP 1
 55af9e8d…fef5b9
 −0.02324129 BTC
 From Hop 1 from Wave 4 park bc1q72k7…aamt
 f02164a9…0db281
 −1.09429601 BTC
 From Wave 4 park 36XfMDAY…1x3G
-Block 961,064
-
-To 334iKwmh…J6gB
-
-f02164a9…0db281
-−0.96227191 BTC
-From Wave 4 park 34nHYNnc…4qDQ
 Block 961,064
 
 To 334iKwmh…J6gB
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,926,286

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,304,043
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,945,602
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  33. source content difference between and source content +40 -8

    Movement feed extended: a new hop-1 spend of 0.02324129 BTC from the Wave 4 park hop at block 961,404 plus three hop-2 entries, and LAST MOVEMENT updated. Wave 2 vault also gained a dust UTXO (3 to 4).

    seen · Captured here 27,436 chars
    What changed from the previous capture 48 lines 
     
 BALANCE ON WATCH
 
-1,367.16813792 BTC
+1,367.16814792 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60760628 BTC
+118.60759628 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,368
-
-30.18476329 BTC from Wave 2 collector
+Block 961,404
+
+0.02324129 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 
 Wave 2 vault
 Consolidated from 1,216 sweeps (via bc1qsjrf5ze…). Chainabuse victim on that sweep sink.
-	bc1qtfrwa4…numu75	45.90253994 BTC
-<live-fiat-value>
-	45.90251994 BTC	3	HELD
+	bc1qtfrwa4…numu75	45.90254994 BTC
+<live-fiat-value>
+	45.90251994 BTC	4	HELD
 
 Wave 2 collector
 Unmoved collector from 93 sweeps at ~10 sat/vB. Chainabuse victim.
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
 
+HOP 1
+55af9e8d…fef5b9
+−0.02324129 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,404
+
+To bc1q55ll…g4q2
+
+HOP 2
+e5530973…acbf62
+−0.00010224 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
+Block 961,384
+
+To bc1qcgjn…tdt7
+
 93df0d26…4eabd4
 −30.18476329 BTC
 From Wave 2 collector bc1qmd5m…8jp6
 Block 961,368
 
 To bc1qez89…dt6n
+
+HOP 2
+d05a5ac8…ac4abe
+−0.00031259 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
+Block 961,148
+
+To bc1qcgjn…tdt7
 
 HOP 1
 24ee02cf…7d11f2
 Block 961,019
 
 To OP_RETURN messenger hub bc1qqa7p…36pr
+
+HOP 2
+5792bac4…1c959d
+−0.00145838 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1q55ll…g4q2
+Block 960,898
+
+To bc1qcgjn…tdt7
 
 HOP 2
 822230d2…e3083a
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,591,544

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,115,662
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,932,350
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  34. source content difference between and source content +5 -5

    Holding 3 received a dust input (89.6232889 to 89.6232989 BTC, UTXOs 2 to 3). BALANCE ON WATCH and MOVED shifted by the same dust amount.

    seen · Captured here 26,944 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,367.16812792 BTC
+1,367.16813792 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.60761628 BTC
+118.60760628 BTC
 
 Reported consolidation has left the holding addresses
 
 	398.47575357 BTC	4	HELD
 
 Holding 3
-	bc1q8jy96f…kwtp3q	89.6232889 BTC
-<live-fiat-value>
-	89.6232789 BTC	2	HELD
+	bc1q8jy96f…kwtp3q	89.6232989 BTC
+<live-fiat-value>
+	89.6232789 BTC	3	HELD
 
 Holding 4
 Unmoved collector remainder
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,650,802

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,586,246
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,895,108
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  35. source content difference between and source content +9 -9

    The 30.18476329 BTC Wave 2 collector spend confirmed at block 961,368 and LAST MOVEMENT was updated to it. Holding 1 gained another dust UTXO (49 to 50).

    seen · Captured here 26,944 chars
    What changed from the previous capture 18 lines 
     
 BALANCE ON WATCH
 
-1,367.1681247 BTC
+1,367.16812792 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-118.6076195 BTC
+118.60761628 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,090
-
-0.00031682 BTC from Hop 1 from Wave 4 park
+Block 961,368
+
+30.18476329 BTC from Wave 2 collector
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02129099 BTC
-<live-fiat-value>
-	562.02021083 BTC	49	HELD
+	bc1qq85v2c…3fcu9r	562.02129421 BTC
+<live-fiat-value>
+	562.02021083 BTC	50	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 93df0d26…4eabd4
 −30.18476329 BTC
 From Wave 2 collector bc1qmd5m…8jp6
-Unconfirmed
+Block 961,368
 
 To bc1qez89…dt6n
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,498,821

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,500,717
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,889,091
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  36. source content difference between and source content +326 -106

    Wave 2 collector bc1qmd5m5k...9n8jp6 was emptied: 30.18476329 BTC moved out in a then-unconfirmed spend, its status flipped to PARTIAL with a 0.00002 BTC dust leftover, MOVED rose from 88.42 to 118.61 BTC and STILL HELD fell from 94.0% to 92.0%.

    seen · Captured here 26,945 chars
    What changed from the previous capture 432 lines 
     TOTAL STOLEN
 
 1,923.80748125 BTC
+
+<live-fiat-value>
 
 Known waves only · total most likely higher
 
 JUL 30
 Galaxy Wave 1 · July 30
 +1,082.65 BTC
+<live-fiat-value>
 JUL 31
 Galaxy Wave 2 · July 31
 +76.16 BTC
+<live-fiat-value>
 JUL 31
 Galaxy Wave 3 · Jul 31–Aug 1
 +208.24 BTC
+<live-fiat-value>
 JUL 31
 Evening wave · July 31
 +1.20115791 BTC
+<live-fiat-value>
 AUG 1
 Morning wave · Aug 1
 +0.33295323 BTC
+<live-fiat-value>
 AUG 2
 Early Aug 2 consolidation
 +64.90947964 BTC
+<live-fiat-value>
 AUG 1
 P2TR wave · Aug 1–3
 +46.97389047 BTC
+<live-fiat-value>
 AUG 3
 Likely Wave 4 · Aug 3
 +443.34 BTC
+<live-fiat-value>
 
 BALANCE ON WATCH
 
-1,397.35284139 BTC
-
-USD pending
+1,367.1681247 BTC
+
+<live-fiat-value>
+<live-fiat-value>
 
 STILL HELD
 
-94.0%
+92.0%
 
 of 1,485.7757442 BTC consolidated
 
 MOVED
 
-88.42290281 BTC
+118.6076195 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02126439 BTC	562.02021083 BTC	45	HELD
+	bc1qq85v2c…3fcu9r	562.02129099 BTC
+<live-fiat-value>
+	562.02021083 BTC	49	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.47576957 BTC	398.47575357 BTC	4	HELD
+	bc1qx76cae…htfhe3	398.47576957 BTC
+<live-fiat-value>
+	398.47575357 BTC	4	HELD
 
 Holding 3
-	bc1q8jy96f…kwtp3q	89.6232889 BTC	89.6232789 BTC	2	HELD
+	bc1q8jy96f…kwtp3q	89.6232889 BTC
+<live-fiat-value>
+	89.6232789 BTC	2	HELD
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.45058754 BTC	32.4505632 BTC	163	HELD
+	bc1qnk4zh9…8fecp0	32.45058754 BTC
+<live-fiat-value>
+	32.4505632 BTC	163	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
 
 Wave 2 vault
 Consolidated from 1,216 sweeps (via bc1qsjrf5ze…). Chainabuse victim on that sweep sink.
-	bc1qtfrwa4…numu75	45.90252994 BTC	45.90251994 BTC	2	HELD
+	bc1qtfrwa4…numu75	45.90253994 BTC
+<live-fiat-value>
+	45.90251994 BTC	3	HELD
 
 Wave 2 collector
 Unmoved collector from 93 sweeps at ~10 sat/vB. Chainabuse victim.
-	bc1qmd5m5k…9n8jp6	30.18477329 BTC	30.18476329 BTC	94	HELD
+	bc1qmd5m5k…9n8jp6	0.00002 BTC
+<live-fiat-value>
+	30.18476329 BTC	2	PARTIAL
 GALAXY WAVE 3 · JUL 31–AUG 1 · 78 vaults
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 3 vault 1
-	bc1qn3uy9j…q595ld	20.49703196 BTC	20.49703196 BTC	1	HELD
+	bc1qn3uy9j…q595ld	20.49703196 BTC
+<live-fiat-value>
+	20.49703196 BTC	1	HELD
 
 Wave 3 vault 2
-	bc1qu5dgcw…fmaygs	15.47824995 BTC	15.47824995 BTC	1	HELD
+	bc1qu5dgcw…fmaygs	15.47824995 BTC
+<live-fiat-value>
+	15.47824995 BTC	1	HELD
 
 Wave 3 vault 3
-	bc1qt7ktwf…pfsewn	12.26829462 BTC	12.26829462 BTC	1	HELD
+	bc1qt7ktwf…pfsewn	12.26829462 BTC
+<live-fiat-value>
+	12.26829462 BTC	1	HELD
 
 Wave 3 vault 4
-	bc1qh0kkrn…m96ruj	9.74151747 BTC	9.74151747 BTC	1	HELD
+	bc1qh0kkrn…m96ruj	9.74151747 BTC
+<live-fiat-value>
+	9.74151747 BTC	1	HELD
 
 Wave 3 vault 5
-	bc1qajca7e…d23qsa	6.88509195 BTC	6.88509195 BTC	1	HELD
+	bc1qajca7e…d23qsa	6.88509195 BTC
+<live-fiat-value>
+	6.88509195 BTC	1	HELD
 
 Wave 3 vault 6
 Chainabuse victim · ~5.39 BTC Mk3 drain (park → this vault).
-	bc1qysjc4j…pkkx7h	5.39098601 BTC	5.39098601 BTC	1	HELD
+	bc1qysjc4j…pkkx7h	5.39098601 BTC
+<live-fiat-value>
+	5.39098601 BTC	1	HELD
 
 Wave 3 vault 7
 Chainabuse victim · Mk3 drain (park → this vault).
-	bc1qtsp50w…pf73yt	4.53878769 BTC	4.53878769 BTC	1	HELD
+	bc1qtsp50w…pf73yt	4.53878769 BTC
+<live-fiat-value>
+	4.53878769 BTC	1	HELD
 
 Wave 3 vault 8
-	bc1qmqc0vu…x4nlwt	4.14175791 BTC	4.14175791 BTC	1	HELD
+	bc1qmqc0vu…x4nlwt	4.14175791 BTC
+<live-fiat-value>
+	4.14175791 BTC	1	HELD
 
 Wave 3 vault 9
-	bc1qsev2de…dtwlwd	4.01383972 BTC	4.01383972 BTC	1	HELD
+	bc1qsev2de…dtwlwd	4.01383972 BTC
+<live-fiat-value>
+	4.01383972 BTC	1	HELD
 
 Wave 3 vault 10
-	bc1qunepx2…s9ap78	3.98704957 BTC	3.98704957 BTC	1	HELD
+	bc1qunepx2…s9ap78	3.98704957 BTC
+<live-fiat-value>
+	3.98704957 BTC	1	HELD
 
 Wave 3 vault 11
-	bc1qcryst7…qr0epc	3.80969146 BTC	3.80969146 BTC	1	HELD
+	bc1qcryst7…qr0epc	3.80969146 BTC
+<live-fiat-value>
+	3.80969146 BTC	1	HELD
 
 Wave 3 vault 12
-	bc1qfdps7y…cgzcc4	3.63032005 BTC	3.63032005 BTC	1	HELD
+	bc1qfdps7y…cgzcc4	3.63032005 BTC
+<live-fiat-value>
+	3.63032005 BTC	1	HELD
 
 Wave 3 vault 13
-	bc1qvyzwwp…es4sp2	3.39235311 BTC	3.39235311 BTC	1	HELD
+	bc1qvyzwwp…es4sp2	3.39235311 BTC
+<live-fiat-value>
+	3.39235311 BTC	1	HELD
 
 Wave 3 vault 14
-	bc1qg4qf5d…7kkxcf	3.31668005 BTC	3.31668005 BTC	1	HELD
+	bc1qg4qf5d…7kkxcf	3.31668005 BTC
+<live-fiat-value>
+	3.31668005 BTC	1	HELD
 
 Wave 3 vault 15
-	bc1qrw2njs…7acn5e	3.2672638 BTC	3.2672638 BTC	1	HELD
+	bc1qrw2njs…7acn5e	3.2672638 BTC
+<live-fiat-value>
+	3.2672638 BTC	1	HELD
 
 Wave 3 vault 16
-	bc1qhm7vwp…sxflvy	3.00585628 BTC	3.00585628 BTC	1	HELD
+	bc1qhm7vwp…sxflvy	3.00585628 BTC
+<live-fiat-value>
+	3.00585628 BTC	1	HELD
 
 Wave 3 vault 17
-	bc1qunseds…0rwsnx	2.99922036 BTC	2.99922036 BTC	1	HELD
+	bc1qunseds…0rwsnx	2.99922036 BTC
+<live-fiat-value>
+	2.99922036 BTC	1	HELD
 
 Wave 3 vault 18
-	bc1qyqjwt8…m5a848	2.92126799 BTC	2.92126799 BTC	1	HELD
+	bc1qyqjwt8…m5a848	2.92126799 BTC
+<live-fiat-value>
+	2.92126799 BTC	1	HELD
 
 Wave 3 vault 19
-	bc1qhx7w9u…gwadeu	2.8116249 BTC	2.8116249 BTC	1	HELD
+	bc1qhx7w9u…gwadeu	2.8116249 BTC
+<live-fiat-value>
+	2.8116249 BTC	1	HELD
 
 Wave 3 vault 20
-	bc1qe68n9f…7226a5	2.73894035 BTC	2.73894035 BTC	1	HELD
+	bc1qe68n9f…7226a5	2.73894035 BTC
+<live-fiat-value>
+	2.73894035 BTC	1	HELD
 
 Wave 3 vault 21
-	bc1qy76lxf…asslyf	2.72482097 BTC	2.72482097 BTC	1	HELD
+	bc1qy76lxf…asslyf	2.72482097 BTC
+<live-fiat-value>
+	2.72482097 BTC	1	HELD
 
 Wave 3 vault 22
-	bc1q7qu3wy…0qacp4	2.6494159 BTC	2.6494159 BTC	1	HELD
+	bc1q7qu3wy…0qacp4	2.6494159 BTC
+<live-fiat-value>
+	2.6494159 BTC	1	HELD
 
 Wave 3 vault 23
-	bc1qe7lwuc…vxafaj	2.52064635 BTC	2.52064635 BTC	1	HELD
+	bc1qe7lwuc…vxafaj	2.52064635 BTC
+<live-fiat-value>
+	2.52064635 BTC	1	HELD
 
 Wave 3 vault 24
-	bc1qw3mqlq…wxyhph	2.50784278 BTC	2.50784278 BTC	1	HELD
+	bc1qw3mqlq…wxyhph	2.50784278 BTC
+<live-fiat-value>
+	2.50784278 BTC	1	HELD
 
 Wave 3 vault 25
-	bc1q48yxfm…u4r4zn	2.20411992 BTC	2.20411992 BTC	1	HELD
+	bc1q48yxfm…u4r4zn	2.20411992 BTC
+<live-fiat-value>
+	2.20411992 BTC	1	HELD
 
 Wave 3 vault 26
-	bc1q4jg9dq…7pmdnh	2.18639261 BTC	2.18639261 BTC	1	HELD
+	bc1q4jg9dq…7pmdnh	2.18639261 BTC
+<live-fiat-value>
+	2.18639261 BTC	1	HELD
 
 Wave 3 vault 27
-	bc1qvlaxcm…9kqr94	2.08421608 BTC	2.08421608 BTC	1	HELD
+	bc1qvlaxcm…9kqr94	2.08421608 BTC
+<live-fiat-value>
+	2.08421608 BTC	1	HELD
 
 Wave 3 vault 28
-	bc1qmfyggr…lq084x	2.05746782 BTC	2.05746782 BTC	1	HELD
+	bc1qmfyggr…lq084x	2.05746782 BTC
+<live-fiat-value>
+	2.05746782 BTC	1	HELD
 
 Wave 3 vault 29
-	bc1qr4jfp7…4ylgjt	2.02848692 BTC	2.02848692 BTC	1	HELD
+	bc1qr4jfp7…4ylgjt	2.02848692 BTC
+<live-fiat-value>
+	2.02848692 BTC	1	HELD
 
 Wave 3 vault 30
-	bc1q4x7ydy…urffxu	1.73373065 BTC	1.73373065 BTC	1	HELD
+	bc1q4x7ydy…urffxu	1.73373065 BTC
+<live-fiat-value>
+	1.73373065 BTC	1	HELD
 
 Wave 3 vault 31
-	bc1qkz22xl…ulkacd	1.69188357 BTC	1.69188357 BTC	1	HELD
+	bc1qkz22xl…ulkacd	1.69188357 BTC
+<live-fiat-value>
+	1.69188357 BTC	1	HELD
 
 Wave 3 vault 32
-	bc1qmhhm9s…m58kkh	1.68228991 BTC	1.68228991 BTC	1	HELD
+	bc1qmhhm9s…m58kkh	1.68228991 BTC
+<live-fiat-value>
+	1.68228991 BTC	1	HELD
 
 Wave 3 vault 33
-	bc1qkaqcsw…9j8lch	1.58669331 BTC	1.58669331 BTC	1	HELD
+	bc1qkaqcsw…9j8lch	1.58669331 BTC
+<live-fiat-value>
+	1.58669331 BTC	1	HELD
 
 Wave 3 vault 34
-	bc1qxkpyzk…tkfqla	1.51069414 BTC	1.51069414 BTC	1	HELD
+	bc1qxkpyzk…tkfqla	1.51069414 BTC
+<live-fiat-value>
+	1.51069414 BTC	1	HELD
 
 Wave 3 vault 35
-	bc1qj3jd8y…j5v27w	1.42355164 BTC	1.42355164 BTC	1	HELD
+	bc1qj3jd8y…j5v27w	1.42355164 BTC
+<live-fiat-value>
+	1.42355164 BTC	1	HELD
 
 Wave 3 vault 36
-	bc1qxuva8w…uddrs5	1.2984018 BTC	1.2984018 BTC	1	HELD
+	bc1qxuva8w…uddrs5	1.2984018 BTC
+<live-fiat-value>
+	1.2984018 BTC	1	HELD
 
 Wave 3 vault 37
-	bc1q3jnv88…0yqva7	1.29341473 BTC	1.29341473 BTC	1	HELD
+	bc1q3jnv88…0yqva7	1.29341473 BTC
+<live-fiat-value>
+	1.29341473 BTC	1	HELD
 
 Wave 3 vault 38
-	bc1q2q8epf…6h0lm2	1.24272696 BTC	1.24272696 BTC	1	HELD
+	bc1q2q8epf…6h0lm2	1.24272696 BTC
+<live-fiat-value>
+	1.24272696 BTC	1	HELD
 
 Wave 3 vault 39
-	bc1qtwx5m0…jfyxru	1.14238463 BTC	1.14238463 BTC	1	HELD
+	bc1qtwx5m0…jfyxru	1.14238463 BTC
+<live-fiat-value>
+	1.14238463 BTC	1	HELD
 
 Wave 3 vault 40
-	bc1qfgv6py…s4h9ae	1.10389012 BTC	1.10389012 BTC	1	HELD
+	bc1qfgv6py…s4h9ae	1.10389012 BTC
+<live-fiat-value>
+	1.10389012 BTC	1	HELD
 
 Wave 3 vault 41
-	bc1qwy642m…65xj4s	1.05327357 BTC	1.05327357 BTC	1	HELD
+	bc1qwy642m…65xj4s	1.05327357 BTC
+<live-fiat-value>
+	1.05327357 BTC	1	HELD
 
 Wave 3 vault 42
-	bc1qtu8suv…4eg09u	1.0430298 BTC	1.0430298 BTC	1	HELD
+	bc1qtu8suv…4eg09u	1.0430298 BTC
+<live-fiat-value>
+	1.0430298 BTC	1	HELD
 
 Wave 3 vault 43
-	bc1qcu3w05…etphx4	1.01976357 BTC	1.01976357 BTC	1	HELD
+	bc1qcu3w05…etphx4	1.01976357 BTC
+<live-fiat-value>
+	1.01976357 BTC	1	HELD
 
 Wave 3 vault 44
-	bc1q3ehq9t…a5yh8j	1.01857988 BTC	1.01857988 BTC	1	HELD
+	bc1q3ehq9t…a5yh8j	1.01857988 BTC
+<live-fiat-value>
+	1.01857988 BTC	1	HELD
 
 Wave 3 vault 45
-	bc1qqu0sp6…ltw5ac	1.01266757 BTC	1.01266757 BTC	1	HELD
+	bc1qqu0sp6…ltw5ac	1.01266757 BTC
+<live-fiat-value>
+	1.01266757 BTC	1	HELD
 
 Wave 3 vault 46
-	bc1qsjltn7…zc0szd	1.0069355 BTC	1.0069355 BTC	1	HELD
+	bc1qsjltn7…zc0szd	1.0069355 BTC
+<live-fiat-value>
+	1.0069355 BTC	1	HELD
 
 Wave 3 vault 47
-	bc1qtl628t…wh9r2j	1.00093255 BTC	1.00093255 BTC	1	HELD
+	bc1qtl628t…wh9r2j	1.00093255 BTC
+<live-fiat-value>
+	1.00093255 BTC	1	HELD
 
 Wave 3 vault 48
-	bc1qa3mfkw…dzd64z	1.00040325 BTC	1.00040325 BTC	1	HELD
+	bc1qa3mfkw…dzd64z	1.00040325 BTC
+<live-fiat-value>
+	1.00040325 BTC	1	HELD
 
 Wave 3 vault 49
-	bc1q5c6m8q…5mgfa2	1.0001318 BTC	1.0001318 BTC	1	HELD
+	bc1q5c6m8q…5mgfa2	1.0001318 BTC
+<live-fiat-value>
+	1.0001318 BTC	1	HELD
 
 Wave 3 vault 50
-	bc1qt2k74x…3kf758	0.9949898 BTC	0.9949898 BTC	1	HELD
+	bc1qt2k74x…3kf758	0.9949898 BTC
+<live-fiat-value>
+	0.9949898 BTC	1	HELD
 
 Wave 3 vault 51
-	bc1q7fgsar…msv9fj	0.9934878 BTC	0.9934878 BTC	1	HELD
+	bc1q7fgsar…msv9fj	0.9934878 BTC
+<live-fiat-value>
+	0.9934878 BTC	1	HELD
 
 Wave 3 vault 52
-	bc1qrx4r4d…kutf0n	0.85192202 BTC	0.85192202 BTC	1	HELD
+	bc1qrx4r4d…kutf0n	0.85192202 BTC
+<live-fiat-value>
+	0.85192202 BTC	1	HELD
 
 Wave 3 vault 53
-	bc1q464usw…slhtk0	0.85074447 BTC	0.85074447 BTC	1	HELD
+	bc1q464usw…slhtk0	0.85074447 BTC
+<live-fiat-value>
+	0.85074447 BTC	1	HELD
 
 Wave 3 vault 54
-	bc1qkl4vkx…hglgc2	0.83717676 BTC	0.83717676 BTC	1	HELD
+	bc1qkl4vkx…hglgc2	0.83717676 BTC
+<live-fiat-value>
+	0.83717676 BTC	1	HELD
 
 Wave 3 vault 55
-	bc1q893u28…2p64rx	0.8353508 BTC	0.8353508 BTC	1	HELD
+	bc1q893u28…2p64rx	0.8353508 BTC
+<live-fiat-value>
+	0.8353508 BTC	1	HELD
 
 Wave 3 vault 56
-	bc1q75t6ku…ue6rl2	0.81458411 BTC	0.81458411 BTC	1	HELD
+	bc1q75t6ku…ue6rl2	0.81458411 BTC
+<live-fiat-value>
+	0.81458411 BTC	1	HELD
 
 Wave 3 vault 57
-	bc1qc5j2jg…822mln	0.80094372 BTC	0.80094372 BTC	1	HELD
+	bc1qc5j2jg…822mln	0.80094372 BTC
+<live-fiat-value>
+	0.80094372 BTC	1	HELD
 
 Wave 3 vault 58
-	bc1qnjpfhc…a8tqc5	0.77812263 BTC	0.77812263 BTC	1	HELD
+	bc1qnjpfhc…a8tqc5	0.77812263 BTC
+<live-fiat-value>
+	0.77812263 BTC	1	HELD
 
 Wave 3 vault 59
-	bc1q64nmnz…su2td0	0.77291101 BTC	0.77291101 BTC	1	HELD
+	bc1q64nmnz…su2td0	0.77291101 BTC
+<live-fiat-value>
+	0.77291101 BTC	1	HELD
 
 Wave 3 vault 60
-	bc1qassuuk…hh93zs	0.7596758 BTC	0.7596758 BTC	1	HELD
+	bc1qassuuk…hh93zs	0.7596758 BTC
+<live-fiat-value>
+	0.7596758 BTC	1	HELD
 
 Wave 3 vault 61
-	bc1qxhju5x…h2snjc	0.75536701 BTC	0.75536701 BTC	1	HELD
+	bc1qxhju5x…h2snjc	0.75536701 BTC
+<live-fiat-value>
+	0.75536701 BTC	1	HELD
 
 Wave 3 vault 62
-	bc1qq2y3q0…gjpzkl	0.70431447 BTC	0.70431447 BTC	1	HELD
+	bc1qq2y3q0…gjpzkl	0.70431447 BTC
+<live-fiat-value>
+	0.70431447 BTC	1	HELD
 
 Wave 3 vault 63
-	bc1q22envz…5knnwx	0.70394873 BTC	0.70394873 BTC	1	HELD
+	bc1q22envz…5knnwx	0.70394873 BTC
+<live-fiat-value>
+	0.70394873 BTC	1	HELD
 
 Wave 3 vault 64
-	bc1q6vc45u…9yklv7	0.69906337 BTC	0.69906337 BTC	1	HELD
+	bc1q6vc45u…9yklv7	0.69906337 BTC
+<live-fiat-value>
+	0.69906337 BTC	1	HELD
 
 Wave 3 vault 65
-	bc1qrmp5a6…7z8w8m	0.67899409 BTC	0.67899409 BTC	1	HELD
+	bc1qrmp5a6…7z8w8m	0.67899409 BTC
+<live-fiat-value>
+	0.67899409 BTC	1	HELD
 
 Wave 3 vault 66
-	bc1qu673md…hz5ztq	0.66510239 BTC	0.66510239 BTC	1	HELD
+	bc1qu673md…hz5ztq	0.66510239 BTC
+<live-fiat-value>
+	0.66510239 BTC	1	HELD
 
 Wave 3 vault 67
-	bc1qhvrd93…ptvlfn	0.64598208 BTC	0.64598208 BTC	1	HELD
+	bc1qhvrd93…ptvlfn	0.64598208 BTC
+<live-fiat-value>
+	0.64598208 BTC	1	HELD
 
 Wave 3 vault 68
-	bc1q0pyh8m…3m6nkf	0.61847292 BTC	0.61847292 BTC	1	HELD
+	bc1q0pyh8m…3m6nkf	0.61847292 BTC
+<live-fiat-value>
+	0.61847292 BTC	1	HELD
 
 Wave 3 vault 69
-	bc1q5k77u9…lddty4	0.5941699 BTC	0.5941699 BTC	1	HELD
+	bc1q5k77u9…lddty4	0.5941699 BTC
+<live-fiat-value>
+	0.5941699 BTC	1	HELD
 
 Wave 3 vault 70
-	bc1qmkqkq6…l4mgyu	0.58741437 BTC	0.58741437 BTC	1	HELD
+	bc1qmkqkq6…l4mgyu	0.58741437 BTC
+<live-fiat-value>
+	0.58741437 BTC	1	HELD
 
 Wave 3 vault 71
-	bc1qwymjp7…3u33zw	0.58633145 BTC	0.58633145 BTC	1	HELD
+	bc1qwymjp7…3u33zw	0.58633145 BTC
+<live-fiat-value>
+	0.58633145 BTC	1	HELD
 
 Wave 3 vault 72
-	bc1qm2de6c…mnq34p	0.5808048 BTC	0.5808048 BTC	1	HELD
+	bc1qm2de6c…mnq34p	0.5808048 BTC
+<live-fiat-value>
+	0.5808048 BTC	1	HELD
 
 Wave 3 vault 73
-	bc1qcwcxxp…5g6ygk	0.55392397 BTC	0.55392397 BTC	1	HELD
+	bc1qcwcxxp…5g6ygk	0.55392397 BTC
+<live-fiat-value>
+	0.55392397 BTC	1	HELD
 
 Wave 3 vault 74
-	bc1q6vpkjw…37udc6	0.54963327 BTC	0.54963327 BTC	1	HELD
+	bc1q6vpkjw…37udc6	0.54963327 BTC
+<live-fiat-value>
+	0.54963327 BTC	1	HELD
 
 Wave 3 vault 75
-	bc1qtujm6u…wpqs6r	0.54569989 BTC	0.54569989 BTC	1	HELD
+	bc1qtujm6u…wpqs6r	0.54569989 BTC
+<live-fiat-value>
+	0.54569989 BTC	1	HELD
 
 Wave 3 vault 76
-	bc1qfeg6uq…a58my8	0.54132885 BTC	0.54132885 BTC	1	HELD
+	bc1qfeg6uq…a58my8	0.54132885 BTC
+<live-fiat-value>
+	0.54132885 BTC	1	HELD
 
 Wave 3 vault 77
-	bc1qkwhtgu…t8n5zl	0.50695526 BTC	0.5069498 BTC	2	HELD
+	bc1qkwhtgu…t8n5zl	0.50695526 BTC
+<live-fiat-value>
+	0.5069498 BTC	2	HELD
 
 Wave 3 vault 78
-	bc1qkyncy6…sw293h	0.50163823 BTC	0.50163823 BTC	1	HELD
+	bc1qkyncy6…sw293h	0.50163823 BTC
+<live-fiat-value>
+	0.50163823 BTC	1	HELD
 EVENING WAVE · JULY 31
 Source
 
 
 Evening vault
 Jul 31 consolidation (~0.51 BTC). Emptied Aug 2–3 (ETH + BTC rails above). Chainabuse victim.
-	bc1q7rmsw0…lrrcgf	0.00 BTC	0.50980268 BTC	0	EMPTIED
+	bc1q7rmsw0…lrrcgf	0.00 BTC
+<live-fiat-value>
+	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
 0.4998 + 0.1915 BTC stack. Emptied Aug 2 (BTC rail above). Ocean peel also met at the hub (not in report balance).
-	bc1qayw8nr…7w2u0s	0.00 BTC	0.69135523 BTC	0	EMPTIED
+	bc1qayw8nr…7w2u0s	0.00 BTC
+<live-fiat-value>
+	0.69135523 BTC	0	EMPTIED
 MORNING WAVE · AUG 1
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 1 vault
-	bc1qzm5pau…v34mf3	0.33203236 BTC	0.33203236 BTC	16	HELD
+	bc1qzm5pau…v34mf3	0.33203236 BTC
+<live-fiat-value>
+	0.33203236 BTC	16	HELD
 EARLY AUG 2 CONSOLIDATION
 Source
 
 
 Aug 2 vault
 Emptied Aug 4 → Taproot hop → Wasabi CJ cascade (trail above).
-	bc1q0rvn88…jf5q6m	0.00 BTC	64.90373764 BTC	0	EMPTIED
+	bc1q0rvn88…jf5q6m	0.00 BTC
+<live-fiat-value>
+	64.90373764 BTC	0	EMPTIED
 P2TR WAVE · AUG 1–3
 Source
 
 
 P2TR vault
 Chainabuse victim · 62× ~5 sat/vB sweeps (blocks 960737–960750).
-	bc1pum5zf6…8ftmy8	0.50992489 BTC	0.50992489 BTC	62	HELD
+	bc1pum5zf6…8ftmy8	0.50992489 BTC
+<live-fiat-value>
+	0.50992489 BTC	62	HELD
 
 P2TR hop vault
 Consolidate from emptied collector bc1ptd5x… (101 inputs @ block 960736).
-	bc1pdl33jt…luu9ce	36.01585057 BTC	36.01585057 BTC	1	HELD
+	bc1pdl33jt…luu9ce	36.01585057 BTC
+<live-fiat-value>
+	36.01585057 BTC	1	HELD
 
 P2TR vault
 Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897). Emptied Aug 4 — trail below. ETH side (@osint_based): ~205 ETH via THORChain into 0x41B752… → 200 ETH Tornado (2×100); BTC→THOR hop soft (commingled hubs). ~4.44 BTC still on Taproot park bc1prjnv….
 
 ~205 ETH→0x41B752… (via THORChain)
 200 ETH→Tornado.Cash Router · 2×100
-	bc1p0l0xs2…6qlk0h	0.00000872 BTC	10.44811501 BTC	2	PARTIAL
+	bc1p0l0xs2…6qlk0h	0.00000872 BTC
+<live-fiat-value>
+	10.44811501 BTC	2	PARTIAL
 LIKELY WAVE 4 · AUG 3
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 4 park
-	bc1q05g20l…nju0ml	8.55600708 BTC	8.55600708 BTC	1	HELD
+	bc1q05g20l…nju0ml	8.55600708 BTC
+<live-fiat-value>
+	8.55600708 BTC	1	HELD
 
 Wave 4 park
-	bc1qjenjhm…mv4z23	5.07348539 BTC	5.07348539 BTC	1	HELD
+	bc1qjenjhm…mv4z23	5.07348539 BTC
+<live-fiat-value>
+	5.07348539 BTC	1	HELD
 
 Wave 4 park
 Thorn’s unique dual-sweep destination (2 victims → this park).
 ~2.79→Bullish.com · 960793
 ~2.82→Coinbase Prime · 960818 · same cluster as bc1qactq…
-	1N8knQCfjq…WVqfDo	0.00 BTC	5.61303754 BTC	0	EMPTIED
+	1N8knQCfjq…WVqfDo	0.00 BTC
+<live-fiat-value>
+	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
 Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 342L6n3b… + 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window.
-	35dHFzKHn4…X4wNxH	0.00 BTC	2.17767618 BTC	0	EMPTIED
+	35dHFzKHn4…X4wNxH	0.00 BTC
+<live-fiat-value>
+	2.17767618 BTC	0	EMPTIED
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	342L6n3b61…TSjZtz	0.00 BTC	2.02374869 BTC	0	EMPTIED
+	342L6n3b61…TSjZtz	0.00 BTC
+<live-fiat-value>
+	2.02374869 BTC	0	EMPTIED
 
 Wave 4 park
-	bc1q65e6cd…yce9u8	1.14852067 BTC	1.14852067 BTC	1	HELD
+	bc1q65e6cd…yce9u8	1.14852067 BTC
+<live-fiat-value>
+	1.14852067 BTC	1	HELD
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	36XfMDAYuC…1F1x3G	0.00 BTC	1.09429601 BTC	0	EMPTIED
+	36XfMDAYuC…1F1x3G	0.00 BTC
+<live-fiat-value>
+	1.09429601 BTC	0	EMPTIED
 
 Wave 4 park
-	bc1qcmnjt0…rfjvtl	1.04998888 BTC	1.04998888 BTC	1	HELD
+	bc1qcmnjt0…rfjvtl	1.04998888 BTC
+<live-fiat-value>
+	1.04998888 BTC	1	HELD
 
 Wave 4 park
-	bc1pj7f355…4sulc2	1.03514173 BTC	1.03514173 BTC	1	HELD
+	bc1pj7f355…4sulc2	1.03514173 BTC
+<live-fiat-value>
+	1.03514173 BTC	1	HELD
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	34nHYNnc9D…jP4qDQ	0.00 BTC	0.96227191 BTC	0	EMPTIED
+	34nHYNnc9D…jP4qDQ	0.00 BTC
+<live-fiat-value>
+	0.96227191 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
+
+93df0d26…4eabd4
+−30.18476329 BTC
+From Wave 2 collector bc1qmd5m…8jp6
+Unconfirmed
+
+To bc1qez89…dt6n
 
 HOP 1
 24ee02cf…7d11f2
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,631,564

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,575,420
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,894,346
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  37. source content difference between and source content +113 -326

    Holding 1 gained another dust input (562.02124901 to 562.02126439 BTC, UTXOs 44 to 45). The same capture also failed to render the live fiat conversions, collapsing the <live-fiat-value> placeholders to "USD pending"; that part is rendering noise.

    seen · Captured here 25,821 chars
    What changed from the previous capture 439 lines 
     TOTAL STOLEN
 
 1,923.80748125 BTC
-
-<live-fiat-value>
 
 Known waves only · total most likely higher
 
 JUL 30
 Galaxy Wave 1 · July 30
 +1,082.65 BTC
-<live-fiat-value>
 JUL 31
 Galaxy Wave 2 · July 31
 +76.16 BTC
-<live-fiat-value>
 JUL 31
 Galaxy Wave 3 · Jul 31–Aug 1
 +208.24 BTC
-<live-fiat-value>
 JUL 31
 Evening wave · July 31
 +1.20115791 BTC
-<live-fiat-value>
 AUG 1
 Morning wave · Aug 1
 +0.33295323 BTC
-<live-fiat-value>
 AUG 2
 Early Aug 2 consolidation
 +64.90947964 BTC
-<live-fiat-value>
 AUG 1
 P2TR wave · Aug 1–3
 +46.97389047 BTC
-<live-fiat-value>
 AUG 3
 Likely Wave 4 · Aug 3
 +443.34 BTC
-<live-fiat-value>
 
 BALANCE ON WATCH
 
-1,397.35282601 BTC
-
-<live-fiat-value>
-<live-fiat-value>
+1,397.35284139 BTC
+
+USD pending
 
 STILL HELD
 
 
 MOVED
 
-88.42291819 BTC
+88.42290281 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02124901 BTC
-<live-fiat-value>
-	562.02021083 BTC	44	HELD
+	bc1qq85v2c…3fcu9r	562.02126439 BTC	562.02021083 BTC	45	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.47576957 BTC
-<live-fiat-value>
-	398.47575357 BTC	4	HELD
+	bc1qx76cae…htfhe3	398.47576957 BTC	398.47575357 BTC	4	HELD
 
 Holding 3
-	bc1q8jy96f…kwtp3q	89.6232889 BTC
-<live-fiat-value>
-	89.6232789 BTC	2	HELD
+	bc1q8jy96f…kwtp3q	89.6232889 BTC	89.6232789 BTC	2	HELD
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.45058754 BTC
-<live-fiat-value>
-	32.4505632 BTC	163	HELD
+	bc1qnk4zh9…8fecp0	32.45058754 BTC	32.4505632 BTC	163	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
 
 Wave 2 vault
 Consolidated from 1,216 sweeps (via bc1qsjrf5ze…). Chainabuse victim on that sweep sink.
-	bc1qtfrwa4…numu75	45.90252994 BTC
-<live-fiat-value>
-	45.90251994 BTC	2	HELD
+	bc1qtfrwa4…numu75	45.90252994 BTC	45.90251994 BTC	2	HELD
 
 Wave 2 collector
 Unmoved collector from 93 sweeps at ~10 sat/vB. Chainabuse victim.
-	bc1qmd5m5k…9n8jp6	30.18477329 BTC
-<live-fiat-value>
-	30.18476329 BTC	94	HELD
+	bc1qmd5m5k…9n8jp6	30.18477329 BTC	30.18476329 BTC	94	HELD
 GALAXY WAVE 3 · JUL 31–AUG 1 · 78 vaults
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 3 vault 1
-	bc1qn3uy9j…q595ld	20.49703196 BTC
-<live-fiat-value>
-	20.49703196 BTC	1	HELD
+	bc1qn3uy9j…q595ld	20.49703196 BTC	20.49703196 BTC	1	HELD
 
 Wave 3 vault 2
-	bc1qu5dgcw…fmaygs	15.47824995 BTC
-<live-fiat-value>
-	15.47824995 BTC	1	HELD
+	bc1qu5dgcw…fmaygs	15.47824995 BTC	15.47824995 BTC	1	HELD
 
 Wave 3 vault 3
-	bc1qt7ktwf…pfsewn	12.26829462 BTC
-<live-fiat-value>
-	12.26829462 BTC	1	HELD
+	bc1qt7ktwf…pfsewn	12.26829462 BTC	12.26829462 BTC	1	HELD
 
 Wave 3 vault 4
-	bc1qh0kkrn…m96ruj	9.74151747 BTC
-<live-fiat-value>
-	9.74151747 BTC	1	HELD
+	bc1qh0kkrn…m96ruj	9.74151747 BTC	9.74151747 BTC	1	HELD
 
 Wave 3 vault 5
-	bc1qajca7e…d23qsa	6.88509195 BTC
-<live-fiat-value>
-	6.88509195 BTC	1	HELD
+	bc1qajca7e…d23qsa	6.88509195 BTC	6.88509195 BTC	1	HELD
 
 Wave 3 vault 6
 Chainabuse victim · ~5.39 BTC Mk3 drain (park → this vault).
-	bc1qysjc4j…pkkx7h	5.39098601 BTC
-<live-fiat-value>
-	5.39098601 BTC	1	HELD
+	bc1qysjc4j…pkkx7h	5.39098601 BTC	5.39098601 BTC	1	HELD
 
 Wave 3 vault 7
 Chainabuse victim · Mk3 drain (park → this vault).
-	bc1qtsp50w…pf73yt	4.53878769 BTC
-<live-fiat-value>
-	4.53878769 BTC	1	HELD
+	bc1qtsp50w…pf73yt	4.53878769 BTC	4.53878769 BTC	1	HELD
 
 Wave 3 vault 8
-	bc1qmqc0vu…x4nlwt	4.14175791 BTC
-<live-fiat-value>
-	4.14175791 BTC	1	HELD
+	bc1qmqc0vu…x4nlwt	4.14175791 BTC	4.14175791 BTC	1	HELD
 
 Wave 3 vault 9
-	bc1qsev2de…dtwlwd	4.01383972 BTC
-<live-fiat-value>
-	4.01383972 BTC	1	HELD
+	bc1qsev2de…dtwlwd	4.01383972 BTC	4.01383972 BTC	1	HELD
 
 Wave 3 vault 10
-	bc1qunepx2…s9ap78	3.98704957 BTC
-<live-fiat-value>
-	3.98704957 BTC	1	HELD
+	bc1qunepx2…s9ap78	3.98704957 BTC	3.98704957 BTC	1	HELD
 
 Wave 3 vault 11
-	bc1qcryst7…qr0epc	3.80969146 BTC
-<live-fiat-value>
-	3.80969146 BTC	1	HELD
+	bc1qcryst7…qr0epc	3.80969146 BTC	3.80969146 BTC	1	HELD
 
 Wave 3 vault 12
-	bc1qfdps7y…cgzcc4	3.63032005 BTC
-<live-fiat-value>
-	3.63032005 BTC	1	HELD
+	bc1qfdps7y…cgzcc4	3.63032005 BTC	3.63032005 BTC	1	HELD
 
 Wave 3 vault 13
-	bc1qvyzwwp…es4sp2	3.39235311 BTC
-<live-fiat-value>
-	3.39235311 BTC	1	HELD
+	bc1qvyzwwp…es4sp2	3.39235311 BTC	3.39235311 BTC	1	HELD
 
 Wave 3 vault 14
-	bc1qg4qf5d…7kkxcf	3.31668005 BTC
-<live-fiat-value>
-	3.31668005 BTC	1	HELD
+	bc1qg4qf5d…7kkxcf	3.31668005 BTC	3.31668005 BTC	1	HELD
 
 Wave 3 vault 15
-	bc1qrw2njs…7acn5e	3.2672638 BTC
-<live-fiat-value>
-	3.2672638 BTC	1	HELD
+	bc1qrw2njs…7acn5e	3.2672638 BTC	3.2672638 BTC	1	HELD
 
 Wave 3 vault 16
-	bc1qhm7vwp…sxflvy	3.00585628 BTC
-<live-fiat-value>
-	3.00585628 BTC	1	HELD
+	bc1qhm7vwp…sxflvy	3.00585628 BTC	3.00585628 BTC	1	HELD
 
 Wave 3 vault 17
-	bc1qunseds…0rwsnx	2.99922036 BTC
-<live-fiat-value>
-	2.99922036 BTC	1	HELD
+	bc1qunseds…0rwsnx	2.99922036 BTC	2.99922036 BTC	1	HELD
 
 Wave 3 vault 18
-	bc1qyqjwt8…m5a848	2.92126799 BTC
-<live-fiat-value>
-	2.92126799 BTC	1	HELD
+	bc1qyqjwt8…m5a848	2.92126799 BTC	2.92126799 BTC	1	HELD
 
 Wave 3 vault 19
-	bc1qhx7w9u…gwadeu	2.8116249 BTC
-<live-fiat-value>
-	2.8116249 BTC	1	HELD
+	bc1qhx7w9u…gwadeu	2.8116249 BTC	2.8116249 BTC	1	HELD
 
 Wave 3 vault 20
-	bc1qe68n9f…7226a5	2.73894035 BTC
-<live-fiat-value>
-	2.73894035 BTC	1	HELD
+	bc1qe68n9f…7226a5	2.73894035 BTC	2.73894035 BTC	1	HELD
 
 Wave 3 vault 21
-	bc1qy76lxf…asslyf	2.72482097 BTC
-<live-fiat-value>
-	2.72482097 BTC	1	HELD
+	bc1qy76lxf…asslyf	2.72482097 BTC	2.72482097 BTC	1	HELD
 
 Wave 3 vault 22
-	bc1q7qu3wy…0qacp4	2.6494159 BTC
-<live-fiat-value>
-	2.6494159 BTC	1	HELD
+	bc1q7qu3wy…0qacp4	2.6494159 BTC	2.6494159 BTC	1	HELD
 
 Wave 3 vault 23
-	bc1qe7lwuc…vxafaj	2.52064635 BTC
-<live-fiat-value>
-	2.52064635 BTC	1	HELD
+	bc1qe7lwuc…vxafaj	2.52064635 BTC	2.52064635 BTC	1	HELD
 
 Wave 3 vault 24
-	bc1qw3mqlq…wxyhph	2.50784278 BTC
-<live-fiat-value>
-	2.50784278 BTC	1	HELD
+	bc1qw3mqlq…wxyhph	2.50784278 BTC	2.50784278 BTC	1	HELD
 
 Wave 3 vault 25
-	bc1q48yxfm…u4r4zn	2.20411992 BTC
-<live-fiat-value>
-	2.20411992 BTC	1	HELD
+	bc1q48yxfm…u4r4zn	2.20411992 BTC	2.20411992 BTC	1	HELD
 
 Wave 3 vault 26
-	bc1q4jg9dq…7pmdnh	2.18639261 BTC
-<live-fiat-value>
-	2.18639261 BTC	1	HELD
+	bc1q4jg9dq…7pmdnh	2.18639261 BTC	2.18639261 BTC	1	HELD
 
 Wave 3 vault 27
-	bc1qvlaxcm…9kqr94	2.08421608 BTC
-<live-fiat-value>
-	2.08421608 BTC	1	HELD
+	bc1qvlaxcm…9kqr94	2.08421608 BTC	2.08421608 BTC	1	HELD
 
 Wave 3 vault 28
-	bc1qmfyggr…lq084x	2.05746782 BTC
-<live-fiat-value>
-	2.05746782 BTC	1	HELD
+	bc1qmfyggr…lq084x	2.05746782 BTC	2.05746782 BTC	1	HELD
 
 Wave 3 vault 29
-	bc1qr4jfp7…4ylgjt	2.02848692 BTC
-<live-fiat-value>
-	2.02848692 BTC	1	HELD
+	bc1qr4jfp7…4ylgjt	2.02848692 BTC	2.02848692 BTC	1	HELD
 
 Wave 3 vault 30
-	bc1q4x7ydy…urffxu	1.73373065 BTC
-<live-fiat-value>
-	1.73373065 BTC	1	HELD
+	bc1q4x7ydy…urffxu	1.73373065 BTC	1.73373065 BTC	1	HELD
 
 Wave 3 vault 31
-	bc1qkz22xl…ulkacd	1.69188357 BTC
-<live-fiat-value>
-	1.69188357 BTC	1	HELD
+	bc1qkz22xl…ulkacd	1.69188357 BTC	1.69188357 BTC	1	HELD
 
 Wave 3 vault 32
-	bc1qmhhm9s…m58kkh	1.68228991 BTC
-<live-fiat-value>
-	1.68228991 BTC	1	HELD
+	bc1qmhhm9s…m58kkh	1.68228991 BTC	1.68228991 BTC	1	HELD
 
 Wave 3 vault 33
-	bc1qkaqcsw…9j8lch	1.58669331 BTC
-<live-fiat-value>
-	1.58669331 BTC	1	HELD
+	bc1qkaqcsw…9j8lch	1.58669331 BTC	1.58669331 BTC	1	HELD
 
 Wave 3 vault 34
-	bc1qxkpyzk…tkfqla	1.51069414 BTC
-<live-fiat-value>
-	1.51069414 BTC	1	HELD
+	bc1qxkpyzk…tkfqla	1.51069414 BTC	1.51069414 BTC	1	HELD
 
 Wave 3 vault 35
-	bc1qj3jd8y…j5v27w	1.42355164 BTC
-<live-fiat-value>
-	1.42355164 BTC	1	HELD
+	bc1qj3jd8y…j5v27w	1.42355164 BTC	1.42355164 BTC	1	HELD
 
 Wave 3 vault 36
-	bc1qxuva8w…uddrs5	1.2984018 BTC
-<live-fiat-value>
-	1.2984018 BTC	1	HELD
+	bc1qxuva8w…uddrs5	1.2984018 BTC	1.2984018 BTC	1	HELD
 
 Wave 3 vault 37
-	bc1q3jnv88…0yqva7	1.29341473 BTC
-<live-fiat-value>
-	1.29341473 BTC	1	HELD
+	bc1q3jnv88…0yqva7	1.29341473 BTC	1.29341473 BTC	1	HELD
 
 Wave 3 vault 38
-	bc1q2q8epf…6h0lm2	1.24272696 BTC
-<live-fiat-value>
-	1.24272696 BTC	1	HELD
+	bc1q2q8epf…6h0lm2	1.24272696 BTC	1.24272696 BTC	1	HELD
 
 Wave 3 vault 39
-	bc1qtwx5m0…jfyxru	1.14238463 BTC
-<live-fiat-value>
-	1.14238463 BTC	1	HELD
+	bc1qtwx5m0…jfyxru	1.14238463 BTC	1.14238463 BTC	1	HELD
 
 Wave 3 vault 40
-	bc1qfgv6py…s4h9ae	1.10389012 BTC
-<live-fiat-value>
-	1.10389012 BTC	1	HELD
+	bc1qfgv6py…s4h9ae	1.10389012 BTC	1.10389012 BTC	1	HELD
 
 Wave 3 vault 41
-	bc1qwy642m…65xj4s	1.05327357 BTC
-<live-fiat-value>
-	1.05327357 BTC	1	HELD
+	bc1qwy642m…65xj4s	1.05327357 BTC	1.05327357 BTC	1	HELD
 
 Wave 3 vault 42
-	bc1qtu8suv…4eg09u	1.0430298 BTC
-<live-fiat-value>
-	1.0430298 BTC	1	HELD
+	bc1qtu8suv…4eg09u	1.0430298 BTC	1.0430298 BTC	1	HELD
 
 Wave 3 vault 43
-	bc1qcu3w05…etphx4	1.01976357 BTC
-<live-fiat-value>
-	1.01976357 BTC	1	HELD
+	bc1qcu3w05…etphx4	1.01976357 BTC	1.01976357 BTC	1	HELD
 
 Wave 3 vault 44
-	bc1q3ehq9t…a5yh8j	1.01857988 BTC
-<live-fiat-value>
-	1.01857988 BTC	1	HELD
+	bc1q3ehq9t…a5yh8j	1.01857988 BTC	1.01857988 BTC	1	HELD
 
 Wave 3 vault 45
-	bc1qqu0sp6…ltw5ac	1.01266757 BTC
-<live-fiat-value>
-	1.01266757 BTC	1	HELD
+	bc1qqu0sp6…ltw5ac	1.01266757 BTC	1.01266757 BTC	1	HELD
 
 Wave 3 vault 46
-	bc1qsjltn7…zc0szd	1.0069355 BTC
-<live-fiat-value>
-	1.0069355 BTC	1	HELD
+	bc1qsjltn7…zc0szd	1.0069355 BTC	1.0069355 BTC	1	HELD
 
 Wave 3 vault 47
-	bc1qtl628t…wh9r2j	1.00093255 BTC
-<live-fiat-value>
-	1.00093255 BTC	1	HELD
+	bc1qtl628t…wh9r2j	1.00093255 BTC	1.00093255 BTC	1	HELD
 
 Wave 3 vault 48
-	bc1qa3mfkw…dzd64z	1.00040325 BTC
-<live-fiat-value>
-	1.00040325 BTC	1	HELD
+	bc1qa3mfkw…dzd64z	1.00040325 BTC	1.00040325 BTC	1	HELD
 
 Wave 3 vault 49
-	bc1q5c6m8q…5mgfa2	1.0001318 BTC
-<live-fiat-value>
-	1.0001318 BTC	1	HELD
+	bc1q5c6m8q…5mgfa2	1.0001318 BTC	1.0001318 BTC	1	HELD
 
 Wave 3 vault 50
-	bc1qt2k74x…3kf758	0.9949898 BTC
-<live-fiat-value>
-	0.9949898 BTC	1	HELD
+	bc1qt2k74x…3kf758	0.9949898 BTC	0.9949898 BTC	1	HELD
 
 Wave 3 vault 51
-	bc1q7fgsar…msv9fj	0.9934878 BTC
-<live-fiat-value>
-	0.9934878 BTC	1	HELD
+	bc1q7fgsar…msv9fj	0.9934878 BTC	0.9934878 BTC	1	HELD
 
 Wave 3 vault 52
-	bc1qrx4r4d…kutf0n	0.85192202 BTC
-<live-fiat-value>
-	0.85192202 BTC	1	HELD
+	bc1qrx4r4d…kutf0n	0.85192202 BTC	0.85192202 BTC	1	HELD
 
 Wave 3 vault 53
-	bc1q464usw…slhtk0	0.85074447 BTC
-<live-fiat-value>
-	0.85074447 BTC	1	HELD
+	bc1q464usw…slhtk0	0.85074447 BTC	0.85074447 BTC	1	HELD
 
 Wave 3 vault 54
-	bc1qkl4vkx…hglgc2	0.83717676 BTC
-<live-fiat-value>
-	0.83717676 BTC	1	HELD
+	bc1qkl4vkx…hglgc2	0.83717676 BTC	0.83717676 BTC	1	HELD
 
 Wave 3 vault 55
-	bc1q893u28…2p64rx	0.8353508 BTC
-<live-fiat-value>
-	0.8353508 BTC	1	HELD
+	bc1q893u28…2p64rx	0.8353508 BTC	0.8353508 BTC	1	HELD
 
 Wave 3 vault 56
-	bc1q75t6ku…ue6rl2	0.81458411 BTC
-<live-fiat-value>
-	0.81458411 BTC	1	HELD
+	bc1q75t6ku…ue6rl2	0.81458411 BTC	0.81458411 BTC	1	HELD
 
 Wave 3 vault 57
-	bc1qc5j2jg…822mln	0.80094372 BTC
-<live-fiat-value>
-	0.80094372 BTC	1	HELD
+	bc1qc5j2jg…822mln	0.80094372 BTC	0.80094372 BTC	1	HELD
 
 Wave 3 vault 58
-	bc1qnjpfhc…a8tqc5	0.77812263 BTC
-<live-fiat-value>
-	0.77812263 BTC	1	HELD
+	bc1qnjpfhc…a8tqc5	0.77812263 BTC	0.77812263 BTC	1	HELD
 
 Wave 3 vault 59
-	bc1q64nmnz…su2td0	0.77291101 BTC
-<live-fiat-value>
-	0.77291101 BTC	1	HELD
+	bc1q64nmnz…su2td0	0.77291101 BTC	0.77291101 BTC	1	HELD
 
 Wave 3 vault 60
-	bc1qassuuk…hh93zs	0.7596758 BTC
-<live-fiat-value>
-	0.7596758 BTC	1	HELD
+	bc1qassuuk…hh93zs	0.7596758 BTC	0.7596758 BTC	1	HELD
 
 Wave 3 vault 61
-	bc1qxhju5x…h2snjc	0.75536701 BTC
-<live-fiat-value>
-	0.75536701 BTC	1	HELD
+	bc1qxhju5x…h2snjc	0.75536701 BTC	0.75536701 BTC	1	HELD
 
 Wave 3 vault 62
-	bc1qq2y3q0…gjpzkl	0.70431447 BTC
-<live-fiat-value>
-	0.70431447 BTC	1	HELD
+	bc1qq2y3q0…gjpzkl	0.70431447 BTC	0.70431447 BTC	1	HELD
 
 Wave 3 vault 63
-	bc1q22envz…5knnwx	0.70394873 BTC
-<live-fiat-value>
-	0.70394873 BTC	1	HELD
+	bc1q22envz…5knnwx	0.70394873 BTC	0.70394873 BTC	1	HELD
 
 Wave 3 vault 64
-	bc1q6vc45u…9yklv7	0.69906337 BTC
-<live-fiat-value>
-	0.69906337 BTC	1	HELD
+	bc1q6vc45u…9yklv7	0.69906337 BTC	0.69906337 BTC	1	HELD
 
 Wave 3 vault 65
-	bc1qrmp5a6…7z8w8m	0.67899409 BTC
-<live-fiat-value>
-	0.67899409 BTC	1	HELD
+	bc1qrmp5a6…7z8w8m	0.67899409 BTC	0.67899409 BTC	1	HELD
 
 Wave 3 vault 66
-	bc1qu673md…hz5ztq	0.66510239 BTC
-<live-fiat-value>
-	0.66510239 BTC	1	HELD
+	bc1qu673md…hz5ztq	0.66510239 BTC	0.66510239 BTC	1	HELD
 
 Wave 3 vault 67
-	bc1qhvrd93…ptvlfn	0.64598208 BTC
-<live-fiat-value>
-	0.64598208 BTC	1	HELD
+	bc1qhvrd93…ptvlfn	0.64598208 BTC	0.64598208 BTC	1	HELD
 
 Wave 3 vault 68
-	bc1q0pyh8m…3m6nkf	0.61847292 BTC
-<live-fiat-value>
-	0.61847292 BTC	1	HELD
+	bc1q0pyh8m…3m6nkf	0.61847292 BTC	0.61847292 BTC	1	HELD
 
 Wave 3 vault 69
-	bc1q5k77u9…lddty4	0.5941699 BTC
-<live-fiat-value>
-	0.5941699 BTC	1	HELD
+	bc1q5k77u9…lddty4	0.5941699 BTC	0.5941699 BTC	1	HELD
 
 Wave 3 vault 70
-	bc1qmkqkq6…l4mgyu	0.58741437 BTC
-<live-fiat-value>
-	0.58741437 BTC	1	HELD
+	bc1qmkqkq6…l4mgyu	0.58741437 BTC	0.58741437 BTC	1	HELD
 
 Wave 3 vault 71
-	bc1qwymjp7…3u33zw	0.58633145 BTC
-<live-fiat-value>
-	0.58633145 BTC	1	HELD
+	bc1qwymjp7…3u33zw	0.58633145 BTC	0.58633145 BTC	1	HELD
 
 Wave 3 vault 72
-	bc1qm2de6c…mnq34p	0.5808048 BTC
-<live-fiat-value>
-	0.5808048 BTC	1	HELD
+	bc1qm2de6c…mnq34p	0.5808048 BTC	0.5808048 BTC	1	HELD
 
 Wave 3 vault 73
-	bc1qcwcxxp…5g6ygk	0.55392397 BTC
-<live-fiat-value>
-	0.55392397 BTC	1	HELD
+	bc1qcwcxxp…5g6ygk	0.55392397 BTC	0.55392397 BTC	1	HELD
 
 Wave 3 vault 74
-	bc1q6vpkjw…37udc6	0.54963327 BTC
-<live-fiat-value>
-	0.54963327 BTC	1	HELD
+	bc1q6vpkjw…37udc6	0.54963327 BTC	0.54963327 BTC	1	HELD
 
 Wave 3 vault 75
-	bc1qtujm6u…wpqs6r	0.54569989 BTC
-<live-fiat-value>
-	0.54569989 BTC	1	HELD
+	bc1qtujm6u…wpqs6r	0.54569989 BTC	0.54569989 BTC	1	HELD
 
 Wave 3 vault 76
-	bc1qfeg6uq…a58my8	0.54132885 BTC
-<live-fiat-value>
-	0.54132885 BTC	1	HELD
+	bc1qfeg6uq…a58my8	0.54132885 BTC	0.54132885 BTC	1	HELD
 
 Wave 3 vault 77
-	bc1qkwhtgu…t8n5zl	0.50695526 BTC
-<live-fiat-value>
-	0.5069498 BTC	2	HELD
+	bc1qkwhtgu…t8n5zl	0.50695526 BTC	0.5069498 BTC	2	HELD
 
 Wave 3 vault 78
-	bc1qkyncy6…sw293h	0.50163823 BTC
-<live-fiat-value>
-	0.50163823 BTC	1	HELD
+	bc1qkyncy6…sw293h	0.50163823 BTC	0.50163823 BTC	1	HELD
 EVENING WAVE · JULY 31
 Source
 
 
 Evening vault
 Jul 31 consolidation (~0.51 BTC). Emptied Aug 2–3 (ETH + BTC rails above). Chainabuse victim.
-	bc1q7rmsw0…lrrcgf	0.00 BTC
-<live-fiat-value>
-	0.50980268 BTC	0	EMPTIED
+	bc1q7rmsw0…lrrcgf	0.00 BTC	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
 0.4998 + 0.1915 BTC stack. Emptied Aug 2 (BTC rail above). Ocean peel also met at the hub (not in report balance).
-	bc1qayw8nr…7w2u0s	0.00 BTC
-<live-fiat-value>
-	0.69135523 BTC	0	EMPTIED
+	bc1qayw8nr…7w2u0s	0.00 BTC	0.69135523 BTC	0	EMPTIED
 MORNING WAVE · AUG 1
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 1 vault
-	bc1qzm5pau…v34mf3	0.33203236 BTC
-<live-fiat-value>
-	0.33203236 BTC	16	HELD
+	bc1qzm5pau…v34mf3	0.33203236 BTC	0.33203236 BTC	16	HELD
 EARLY AUG 2 CONSOLIDATION
 Source
 
 
 Aug 2 vault
 Emptied Aug 4 → Taproot hop → Wasabi CJ cascade (trail above).
-	bc1q0rvn88…jf5q6m	0.00 BTC
-<live-fiat-value>
-	64.90373764 BTC	0	EMPTIED
+	bc1q0rvn88…jf5q6m	0.00 BTC	64.90373764 BTC	0	EMPTIED
 P2TR WAVE · AUG 1–3
 Source
 
 
 P2TR vault
 Chainabuse victim · 62× ~5 sat/vB sweeps (blocks 960737–960750).
-	bc1pum5zf6…8ftmy8	0.50992489 BTC
-<live-fiat-value>
-	0.50992489 BTC	62	HELD
+	bc1pum5zf6…8ftmy8	0.50992489 BTC	0.50992489 BTC	62	HELD
 
 P2TR hop vault
 Consolidate from emptied collector bc1ptd5x… (101 inputs @ block 960736).
-	bc1pdl33jt…luu9ce	36.01585057 BTC
-<live-fiat-value>
-	36.01585057 BTC	1	HELD
+	bc1pdl33jt…luu9ce	36.01585057 BTC	36.01585057 BTC	1	HELD
 
 P2TR vault
 Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897). Emptied Aug 4 — trail below. ETH side (@osint_based): ~205 ETH via THORChain into 0x41B752… → 200 ETH Tornado (2×100); BTC→THOR hop soft (commingled hubs). ~4.44 BTC still on Taproot park bc1prjnv….
 
 ~205 ETH→0x41B752… (via THORChain)
 200 ETH→Tornado.Cash Router · 2×100
-	bc1p0l0xs2…6qlk0h	0.00000872 BTC
-<live-fiat-value>
-	10.44811501 BTC	2	PARTIAL
+	bc1p0l0xs2…6qlk0h	0.00000872 BTC	10.44811501 BTC	2	PARTIAL
 LIKELY WAVE 4 · AUG 3
 Source
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 4 park
-	bc1q05g20l…nju0ml	8.55600708 BTC
-<live-fiat-value>
-	8.55600708 BTC	1	HELD
-
-Wave 4 park
-	bc1qjenjhm…mv4z23	5.07348539 BTC
-<live-fiat-value>
-	5.07348539 BTC	1	HELD
+	bc1q05g20l…nju0ml	8.55600708 BTC	8.55600708 BTC	1	HELD
+
+Wave 4 park
+	bc1qjenjhm…mv4z23	5.07348539 BTC	5.07348539 BTC	1	HELD
 
 Wave 4 park
 Thorn’s unique dual-sweep destination (2 victims → this park).
 ~2.79→Bullish.com · 960793
 ~2.82→Coinbase Prime · 960818 · same cluster as bc1qactq…
-	1N8knQCfjq…WVqfDo	0.00 BTC
-<live-fiat-value>
-	5.61303754 BTC	0	EMPTIED
+	1N8knQCfjq…WVqfDo	0.00 BTC	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
 Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 342L6n3b… + 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window.
-	35dHFzKHn4…X4wNxH	0.00 BTC
-<live-fiat-value>
-	2.17767618 BTC	0	EMPTIED
+	35dHFzKHn4…X4wNxH	0.00 BTC	2.17767618 BTC	0	EMPTIED
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	342L6n3b61…TSjZtz	0.00 BTC
-<live-fiat-value>
-	2.02374869 BTC	0	EMPTIED
-
-Wave 4 park
-	bc1q65e6cd…yce9u8	1.14852067 BTC
-<live-fiat-value>
-	1.14852067 BTC	1	HELD
+	342L6n3b61…TSjZtz	0.00 BTC	2.02374869 BTC	0	EMPTIED
+
+Wave 4 park
+	bc1q65e6cd…yce9u8	1.14852067 BTC	1.14852067 BTC	1	HELD
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	36XfMDAYuC…1F1x3G	0.00 BTC
-<live-fiat-value>
-	1.09429601 BTC	0	EMPTIED
-
-Wave 4 park
-	bc1qcmnjt0…rfjvtl	1.04998888 BTC
-<live-fiat-value>
-	1.04998888 BTC	1	HELD
-
-Wave 4 park
-	bc1pj7f355…4sulc2	1.03514173 BTC
-<live-fiat-value>
-	1.03514173 BTC	1	HELD
+	36XfMDAYuC…1F1x3G	0.00 BTC	1.09429601 BTC	0	EMPTIED
+
+Wave 4 park
+	bc1qcmnjt0…rfjvtl	1.04998888 BTC	1.04998888 BTC	1	HELD
+
+Wave 4 park
+	bc1pj7f355…4sulc2	1.03514173 BTC	1.03514173 BTC	1	HELD
 
 Wave 4 park
 Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
-	34nHYNnc9D…jP4qDQ	0.00 BTC
-<live-fiat-value>
-	0.96227191 BTC	0	EMPTIED
+	34nHYNnc9D…jP4qDQ	0.00 BTC	0.96227191 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  38. source content difference between and source content +5 -5

    Another dust-sized input to Holding 1: 562.02123901 to 562.02124901 BTC, UTXOs 43 to 44. Headline totals moved accordingly.

    seen · Captured here 26,856 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,397.35281601 BTC
+1,397.35282601 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42292819 BTC
+88.42291819 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02123901 BTC
-<live-fiat-value>
-	562.02021083 BTC	43	HELD
+	bc1qq85v2c…3fcu9r	562.02124901 BTC
+<live-fiat-value>
+	562.02021083 BTC	44	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,893,202

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,722,660
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,904,704
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  39. source content difference between and source content +5 -5

    Small inbound dust on Holding 1: balance 562.02113901 to 562.02123901 BTC, UTXOs 42 to 43. BALANCE ON WATCH and MOVED totals shifted by the same dust amount.

    seen · Captured here 26,858 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,397.35271601 BTC
+1,397.35281601 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42302819 BTC
+88.42292819 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02113901 BTC
-<live-fiat-value>
-	562.02021083 BTC	42	HELD
+	bc1qq85v2c…3fcu9r	562.02123901 BTC
+<live-fiat-value>
+	562.02021083 BTC	43	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,293,354

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,947,851
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,920,545
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  40. source content difference between and source content +8 -8

    The tracker updated two watched holding balances by small amounts and raised their displayed transaction counts, from 40 to 42 and from 1 to 2. Its aggregate held and swept BTC totals changed accordingly.

    seen · Captured here 26,858 chars
    What changed from the previous capture 16 lines 
     
 BALANCE ON WATCH
 
-1,397.35269555 BTC
+1,397.35271601 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42304865 BTC
+88.42302819 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02112401 BTC
-<live-fiat-value>
-	562.02021083 BTC	40	HELD
+	bc1qq85v2c…3fcu9r	562.02113901 BTC
+<live-fiat-value>
+	562.02021083 BTC	42	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 	0.54132885 BTC	1	HELD
 
 Wave 3 vault 77
-	bc1qkwhtgu…t8n5zl	0.5069498 BTC
-<live-fiat-value>
-	0.5069498 BTC	1	HELD
+	bc1qkwhtgu…t8n5zl	0.50695526 BTC
+<live-fiat-value>
+	0.5069498 BTC	2	HELD
 
 Wave 3 vault 78
 	bc1qkyncy6…sw293h	0.50163823 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,345,297

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,977,083
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,922,602
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  41. source content difference between and source content +34 -156

    The tracker revised watched and moved balances, added its operator-attributed claimed ETH route through THORChain to Tornado Cash, and changed which later movements it excludes from the feed.

    seen · Captured here 26,855 chars
    What changed from the previous capture 190 lines 
     
 BALANCE ON WATCH
 
-1,397.35239555 BTC
+1,397.35269555 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42334865 BTC
+88.42304865 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,204
-
-1.29140163 BTC from Hop 2 from Hop 1 from Aug 2 vault
+Block 961,090
+
+0.00031682 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02082401 BTC
-<live-fiat-value>
-	562.02021083 BTC	37	HELD
+	bc1qq85v2c…3fcu9r	562.02112401 BTC
+<live-fiat-value>
+	562.02021083 BTC	40	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 	36.01585057 BTC	1	HELD
 
 P2TR vault
-Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897). Emptied Aug 4 — trail below.
+Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897). Emptied Aug 4 — trail below. ETH side (@osint_based): ~205 ETH via THORChain into 0x41B752… → 200 ETH Tornado (2×100); BTC→THOR hop soft (commingled hubs). ~4.44 BTC still on Taproot park bc1prjnv….
 
 AUG 4 CASH-OUT · LATER P2TR VAULT (~10.45)
 
 ~2.43→Binance deposit · 961046 · from bc1q2nfx… change chain · 57a9d5f2…7c90bc
 ~1.81→Binance deposit · 961046 · includes vault UTXO taint via prior consolidate · 1c09bf59…af961f
 ~5.33→Binance hot · 961043 · 13i9Za… sweep · e8c70a9d…15ce29
+
+Parallel ETH rail (@osint_based) · Aug 4 — BTC→THOR hop soft
+
+~205 ETH→0x41B752… (via THORChain)
+200 ETH→Tornado.Cash Router · 2×100
 	bc1p0l0xs2…6qlk0h	0.00000872 BTC
 <live-fiat-value>
 	10.44811501 BTC	2	PARTIAL
 	0.96227191 BTC	0	EMPTIED
 Movement feed
 
-Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
-
-HOP 2
-02d7df6b…d69ec4
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qtp7f…gn4v
-Block 961,204
-
-To bc1qg4tw…t4tu, bc1q2kg7…rr6x, bc1qa8wa…jqmr +330 more
-
-HOP 2
-5ebdd8c2…a3ade5
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qrrx3…hy4j
-Block 961,187
-
-To bc1q9tpc…mwu6, bc1q92mu…7ckk, bc1qgnu8…yupa +447 more
-
-HOP 2
-716796bb…5bf37b
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qkmpp…qtky
-Block 961,184
-
-To bc1q99hg…6u46, bc1qnkre…v7z6, bc1pwh5y…fdhs +380 more
-
-HOP 2
-3e45e90f…4c11f0
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1pr0h7…5ej8
-Block 961,103
-
-To bc1q89tx…8ue8, bc1qju80…mfh5, bc1qnq55…rkva +397 more
-
-HOP 2
-80f11c77…8cbf90
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qyhr4…k9jv
-Block 961,093
-
-To bc1qy9u8…hrc6, bc1qg83g…lyd5, bc1qf35y…ad8k +499 more
+Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Surplus through a vault that still holds its reported balance, later peels through a hop after it already cashed out to a known exit, and CoinJoin-scale fan-outs are ignored.
 
 HOP 1
 24ee02cf…7d11f2
 To bc1q55ll…g4q2
 
 HOP 2
-11a3edd2…df46c1
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1pyym5…hfw9
-Block 961,084
-
-To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
-
-HOP 2
-11a3edd2…df46c1
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qvznm…5t7e
-Block 961,084
-
-To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
-
-HOP 2
-11a3edd2…df46c1
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qyzsq…qvdx
-Block 961,084
-
-To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
-
-HOP 2
-3bdac8ed…cdf935
-−54.31783009 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qajcr…2d3t
-Block 961,082
-
-To bc1qq6s7…y2fr, bc1qp9cn…vyzf, bc1qsp57…c4ad +371 more
-
-HOP 2
-65c79326…638de0
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1pxs72…0pct
-Block 961,077
-
-To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
-
-HOP 2
-65c79326…638de0
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1q5h2t…22mf
-Block 961,077
-
-To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
-
-HOP 2
-65c79326…638de0
-−1.29140163 BTC
-From Hop 2 from Hop 1 from Aug 2 vault bc1qtmwr…rwz8
-Block 961,077
-
-To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
-
-HOP 2
 93eeb9e7…d9fbc6
 −1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qs0zc…l3n6
 
 To bc1qh6me…z56m
 
-HOP 1
-f3ee6e61…c37b24
-−64.90373154 BTC
-From Hop 1 from Aug 2 vault bc1pynd6…7h92
-Block 961,069
-
-To bc1qajcr…2d3t, bc1qrrx3…hy4j, bc1qyzsq…qvdx +379 more
-
 e3274a1b…2b3ddf
 −64.90373764 BTC
 From Aug 2 vault bc1q0rvn…5q6m
 Block 961,064
 
 To 334iKwmh…J6gB
-
-d969fd1c…7e16ef
-−4.43721266 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,048
-
-To bc1prjnv…prpr
-
-92718385…cac6b9
-−2.00018023 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,037
-
-To OP_RETURN messenger hub bc1q2nfx…kyyq
-
-2c7075a3…5012cc
-−1.00017899 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,032
-
-To OP_RETURN messenger hub bc1qqa7p…36pr
-
-1a454301…c772c2
-−2.00017714 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,026
-
-To OP_RETURN messenger hub bc1q2nfx…kyyq
-
-064eb61d…7ddd4f
-−1.00017823 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,021
-
-To OP_RETURN messenger hub bc1qqa7p…36pr
 
 780ea043…cf0326
 −0.01017904 BTC
 
 To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
 
-23a84f33…bc709c
-−2.81971503 BTC
-From Wave 4 park 1N8knQCf…qfDo
-Block 960,818
-
-To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
-
 HOP 2
 24ed08ad…a7f583
 −4.27762101 BTC
 Block 960,661
 
 To P2SH service hub 3KMmeqPe…qtc8
+
+5ecc3052…a8bf87
+−0.69135523 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Block 960,658
+
+To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
 
 Am I at risk?
 
 
 Aug 3: ~0.51 BTC Chainabuse-corroborated P2TR sink plus two larger sibling Taproot consolidations (~36 + ~10 BTC) at ~5 sat/vB — distinct from Wave 4.
 
+@osint_based · P2TR later-vault ETH rail
+
+Aug 5: later P2TR vault cash-out — ~205 ETH via THORChain into 0x41B752… → 200 ETH Tornado Cash (2×100). Same Kelbie later vault (bc1p0l0…), not a new cluster; BTC→THOR amount/path soft through commingled hubs. ~4.44 BTC still parked on bc1prjnv….
+
 Evan Schoenberg
 
 Evening July 31 low-fee (~2 sat/vB) sweeps into a separate vault; Aug 1 hop consolidation (incl. delayed ~0.19 BTC) raised the watched cluster to ~1.20 BTC.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,125,982

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,853,661
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,913,919
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  42. source content difference between and source content +8 -7

    The tracker added a hop-two 1.29140163 BTC fan-out record and removed an earlier 0.69135523 BTC Aug. 1 vault movement from the displayed feed.

    seen · Captured here 28,785 chars
    What changed from the previous capture 15 lines 
     HOP 2
 65c79326…638de0
 −1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1pxs72…0pct
+Block 961,077
+
+To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
+
+HOP 2
+65c79326…638de0
+−1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1q5h2t…22mf
 Block 961,077
 
 Block 960,661
 
 To P2SH service hub 3KMmeqPe…qtc8
-
-5ecc3052…a8bf87
-−0.69135523 BTC
-From Aug 1 hop vault bc1qayw8…2u0s
-Block 960,658
-
-To bc1qsd9t…jah8, bc1qvrpc…cddc
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,316,439

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,960,843
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,921,459
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  43. source content difference between and source content +16 -8

    The tracker added further hop-two fan-out records while removing an older Aug. 1 hop-one record from the visible movement feed.

    seen · Captured here 28,736 chars
    What changed from the previous capture 24 lines 
     To bc1q99hg…6u46, bc1qnkre…v7z6, bc1pwh5y…fdhs +380 more
 
 HOP 2
+3e45e90f…4c11f0
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1pr0h7…5ej8
+Block 961,103
+
+To bc1q89tx…8ue8, bc1qju80…mfh5, bc1qnq55…rkva +397 more
+
+HOP 2
 80f11c77…8cbf90
 −1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qyhr4…k9jv
 HOP 2
 11a3edd2…df46c1
 −1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1pyym5…hfw9
+Block 961,084
+
+To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
+
+HOP 2
+11a3edd2…df46c1
+−1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qvznm…5t7e
 Block 961,084
 
 Block 960,658
 
 To bc1qsd9t…jah8, bc1qvrpc…cddc
-
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,358,763

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,984,661
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,923,135
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  44. source content difference between and source content +22 -6

    The tracker reported a small increase in the watched balance and additional hop-two movements, including a 1.29140163 BTC fan-out at block 961,204.

    seen · Captured here 28,523 chars
    What changed from the previous capture 28 lines 
     
 BALANCE ON WATCH
 
-1,397.35238017 BTC
+1,397.35239555 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42336403 BTC
+88.42334865 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,187
+Block 961,204
 
 1.29140163 BTC from Hop 2 from Hop 1 from Aug 2 vault
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02080863 BTC
-<live-fiat-value>
-	562.02021083 BTC	36	HELD
+	bc1qq85v2c…3fcu9r	562.02082401 BTC
+<live-fiat-value>
+	562.02021083 BTC	37	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
+02d7df6b…d69ec4
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qtp7f…gn4v
+Block 961,204
+
+To bc1qg4tw…t4tu, bc1q2kg7…rr6x, bc1qa8wa…jqmr +330 more
+
+HOP 2
 5ebdd8c2…a3ade5
 −1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qrrx3…hy4j
 Block 961,187
 
 To bc1q9tpc…mwu6, bc1q92mu…7ckk, bc1qgnu8…yupa +447 more
+
+HOP 2
+716796bb…5bf37b
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qkmpp…qtky
+Block 961,184
+
+To bc1q99hg…6u46, bc1qnkre…v7z6, bc1pwh5y…fdhs +380 more
 
 HOP 2
 80f11c77…8cbf90
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,358,763

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,984,661
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,923,135
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  45. source content difference between and source content +21 -5

    The tracker recorded another 0.00000890 BTC increase at one watched holding, raised its held output count from 35 to 36, and added a 1.29140163 BTC Hop 2 movement with hundreds of outputs.

    seen · Captured here 28,195 chars
    What changed from the previous capture 26 lines 
     
 BALANCE ON WATCH
 
-1,397.35237127 BTC
+1,397.35238017 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42337293 BTC
+88.42336403 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02079973 BTC
-<live-fiat-value>
-	562.02021083 BTC	35	HELD
+	bc1qq85v2c…3fcu9r	562.02080863 BTC
+<live-fiat-value>
+	562.02021083 BTC	36	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 HOP 2
 65c79326…638de0
 −1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1q5h2t…22mf
+Block 961,077
+
+To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
+
+HOP 2
+65c79326…638de0
+−1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qtmwr…rwz8
 Block 961,077
 
 6c85668e…d30bbb
 −0.02374887 BTC
 From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
+
+HOP 1
+6c85668e…d30bbb
+−0.06990788 BTC
+From Hop 1 from Wave 4 park bc1qw79v…83ha
 Block 960,794
 
 To bc1qhfdz…3wcx
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,701,201

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,177,373
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,936,691
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  46. source content difference between and source content +8 -8

    The tracker added a 1.29140163 BTC Hop 2 transaction from the Aug. 2 vault path at block 961076 and its destination, while the live movement feed dropped an older Hop 1 entry.

    seen · Captured here 27,918 chars
    What changed from the previous capture 16 lines 
     
 To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
 
+HOP 2
+93eeb9e7…d9fbc6
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qs0zc…l3n6
+Block 961,076
+
+To bc1qh6me…z56m
+
 HOP 1
 f3ee6e61…c37b24
 −64.90373154 BTC
 6c85668e…d30bbb
 −0.02374887 BTC
 From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
-
-HOP 1
-6c85668e…d30bbb
-−0.06990788 BTC
-From Hop 1 from Wave 4 park bc1qw79v…83ha
 Block 960,794
 
 To bc1qhfdz…3wcx
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,454,954

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$70,038,794
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,926,943
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  47. source content difference between and source content +17 -1

    The tracker added a 1.29140163 BTC movement from the Aug. 2 vault path at block 961187, with hundreds of listed outputs, and restored a previously absent Hop 1 entry in the feed.

    seen · Captured here 27,905 chars
    What changed from the previous capture 18 lines 
     
 LAST MOVEMENT
 
-Block 961,093
+Block 961,187
 
 1.29140163 BTC from Hop 2 from Hop 1 from Aug 2 vault
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
+5ebdd8c2…a3ade5
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qrrx3…hy4j
+Block 961,187
+
+To bc1q9tpc…mwu6, bc1q92mu…7ckk, bc1qgnu8…yupa +447 more
+
+HOP 2
 80f11c77…8cbf90
 −1.29140163 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qyhr4…k9jv
 Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
+HOP 1
+6c85668e…d30bbb
+−0.02374887 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,152,916

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,868,818
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,914,986
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  48. source content difference between and source content +5 -13

    The tracker recorded a 0.00001538 BTC increase at one watched holding and raised its listed held output count from 34 to 35. Its movement feed also no longer showed an older small Hop 1 transaction.

    seen · Captured here 27,628 chars
    What changed from the previous capture 18 lines 
     
 BALANCE ON WATCH
 
-1,397.35235589 BTC
+1,397.35237127 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42338831 BTC
+88.42337293 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02078435 BTC
-<live-fiat-value>
-	562.02021083 BTC	34	HELD
+	bc1qq85v2c…3fcu9r	562.02079973 BTC
+<live-fiat-value>
+	562.02021083 BTC	35	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
-
-HOP 1
-6c85668e…d30bbb
-−0.02374887 BTC
-From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,224,097

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,908,876
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,917,804
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  49. source content difference between and source content +1 -1

    The tracker now says some equal-denomination outputs reached Hyperunit, while qualifying that this does not prove a common operator and continuing to distinguish the unique residual path.

    seen · Captured here 27,741 chars
    What changed from the previous capture 2 lines 
     4 · CJ3
 residual ends · 7× ~7.7484 (anonymity set) · 2 still live: bc1qf35ycf…puad8k, bc1qs3lj4x…y9v9ze · also 2× ~3.8742 · blk 961093 · ~1 sat/vB · 454→502 · 80f11c77…8cbf90
 5 · Remix
-other large outs remixed in further CJs (blks 961102–961160) · no labeled exchange/bridge on the residual path
+other large outs remixed in further CJs (blks 961102–961160) · some equal-denom peels (anonymity set — not proven same operator) hit Hyperunit; no labeled CEX on the unique-residual path. Still watching 2× ~7.75 + unique ~3.40 residual
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$124,139,449

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,861,239
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,914,452
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  50. source content difference between and source content +14 -1

    The tracker replaced a short description of an Aug. 4 trail with a five-step account of a Taproot hop and subsequent Wasabi-style CoinJoin cascade, including residual amounts, blocks and still-live outputs.

    seen · Captured here 27,616 chars
    What changed from the previous capture 15 lines 
     04:03 UTC Aug 2
 PATTERN
 multi-path → one P2WPKH
+
+AUG 4–5 MIX · WASABI-STYLE CASCADE
+
+1 · Empty
+Aug 2 vault→Taproot hop · ~64.90 BTC · blk 961065 · ~5 sat/vB · e3274a1b…2b3ddf
+2 · CJ1
+residual ~54.32 @ bc1qajcrhj…vp2d3t · plus 20× ~1.2914 · blk 961069 · ~2 sat/vB · 324→382 · f3ee6e61…c37b24
+3 · CJ2
+residual ~47.12 @ bc1qq6s7ws…4jy2fr · equal denoms · blk 961082 · ~2 sat/vB · 320→374 · 3bdac8ed…cdf935
+4 · CJ3
+residual ends · 7× ~7.7484 (anonymity set) · 2 still live: bc1qf35ycf…puad8k, bc1qs3lj4x…y9v9ze · also 2× ~3.8742 · blk 961093 · ~1 sat/vB · 454→502 · 80f11c77…8cbf90
+5 · Remix
+other large outs remixed in further CJs (blks 961102–961160) · no labeled exchange/bridge on the residual path
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382; f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC at bc1qajcr…. Residual re-entered a second CJ (~2 sat/vB, 320→374; 3bdac8ed…cdf935): equal denoms (1 / 0.3355 / 0.2 / …) + new residual ~47.12 BTC at bc1qq6s7…. No labeled exchange/bridge deposit on the hop path we followed — trail lost in CoinJoin.
+Emptied Aug 4 → Taproot hop → Wasabi CJ cascade (trail above).
 	bc1q0rvn88…jf5q6m	0.00 BTC
 <live-fiat-value>
 	64.90373764 BTC	0	EMPTIED
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,806,630

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,673,941
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,901,277
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  51. source content difference between and source content +5 -5

    The tracker’s balance on watch increased by 0.00001000 BTC while its moved total fell by the same amount, and Holding 1 gained one UTXO while remaining HELD.

    seen · Captured here 27,392 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,397.35234589 BTC
+1,397.35235589 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-88.42339831 BTC
+88.42338831 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02077435 BTC
-<live-fiat-value>
-	562.02021083 BTC	33	HELD
+	bc1qq85v2c…3fcu9r	562.02078435 BTC
+<live-fiat-value>
+	562.02021083 BTC	34	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,333,374

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,407,609
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,882,541
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  52. source content difference between and source content +8 -0

    The tracker added a Hop 2 transaction (11a3edd2...df46c1) moving 1.29140163 BTC from the Aug. 2 vault's Hop 1 trail in block 961,084, and listed more than 380 output destinations.

    seen · Captured here 27,392 chars
    What changed from the previous capture 8 lines 
     Block 961,090
 
 To bc1q55ll…g4q2
+
+HOP 2
+11a3edd2…df46c1
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qvznm…5t7e
+Block 961,084
+
+To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
 
 HOP 2
 11a3edd2…df46c1
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,175,622

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,318,832
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,876,296
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  53. source content difference between and source content +8 -0

    The tracker added a Hop 2 transaction (65c79326...638de0) moving 1.29140163 BTC from the Aug. 2 vault's Hop 1 trail in block 961,077, and listed its 335 output destinations.

    seen · Captured here 27,228 chars
    What changed from the previous capture 8 lines 
     Block 961,082
 
 To bc1qq6s7…y2fr, bc1qp9cn…vyzf, bc1qsp57…c4ad +371 more
+
+HOP 2
+65c79326…638de0
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qtmwr…rwz8
+Block 961,077
+
+To bc1qvsrp…93hs, bc1qwp64…y9kh, bc1qelpm…c5hg +332 more
 
 HOP 1
 f3ee6e61…c37b24
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,368,002

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,427,097
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,883,912
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  54. source content difference between and source content +17 -1

    The tracker advanced its chain data to block 961,093 and added a Hop 2 transaction from the Aug. 2 vault, plus a later Hop 1 movement from the Wave 4 park.

    seen · Captured here 27,064 chars
    What changed from the previous capture 18 lines 
     
 LAST MOVEMENT
 
-Block 961,084
+Block 961,093
 
 1.29140163 BTC from Hop 2 from Hop 1 from Aug 2 vault
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 2
+80f11c77…8cbf90
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qyhr4…k9jv
+Block 961,093
+
+To bc1qy9u8…hrc6, bc1qg83g…lyd5, bc1qf35y…ad8k +499 more
+
+HOP 1
+24ee02cf…7d11f2
+−0.00031682 BTC
+From Hop 1 from Wave 4 park bc1q72k7…aamt
+Block 961,090
+
+To bc1q55ll…g4q2
 
 HOP 2
 11a3edd2…df46c1
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,518,059

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,511,543
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,889,853
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  55. source content difference between and source content +45 -5

    The tracker added confirmed second-hop movements, including a new CoinJoin, and updated its assessment of the Aug. 2 vault trail.

    seen · Captured here 26,787 chars
    What changed from the previous capture 50 lines 
     
 LAST MOVEMENT
 
-Block 961,069
-
-64.90373154 BTC from Hop 1 from Aug 2 vault
+Block 961,084
+
+1.29140163 BTC from Hop 2 from Hop 1 from Aug 2 vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382; f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC at bc1qajcr…. Residual re-entered a second CJ (mempool, ~2 sat/vB, 320→374; 3bdac8ed…cdf935): equal denoms (1 / 0.3355 / 0.2 / …) + new residual ~47.12 BTC at bc1qq6s7…. No exchange exit yet.
+Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382; f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC at bc1qajcr…. Residual re-entered a second CJ (~2 sat/vB, 320→374; 3bdac8ed…cdf935): equal denoms (1 / 0.3355 / 0.2 / …) + new residual ~47.12 BTC at bc1qq6s7…. No labeled exchange/bridge deposit on the hop path we followed — trail lost in CoinJoin.
 	bc1q0rvn88…jf5q6m	0.00 BTC
 <live-fiat-value>
 	64.90373764 BTC	0	EMPTIED
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
+11a3edd2…df46c1
+−1.29140163 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qyzsq…qvdx
+Block 961,084
+
+To bc1qqyk6…dyh2, bc1qqf2k…d8nc, bc1qz2yc…racr +380 more
+
+HOP 2
 3bdac8ed…cdf935
 −54.31783009 BTC
 From Hop 2 from Hop 1 from Aug 2 vault bc1qajcr…2d3t
-Unconfirmed
+Block 961,082
 
 To bc1qq6s7…y2fr, bc1qp9cn…vyzf, bc1qsp57…c4ad +371 more
 
 
 To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
 
+HOP 2
+24ed08ad…a7f583
+−4.27762101 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
+Block 960,797
+
+To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
 HOP 1
 6c85668e…d30bbb
 −0.02374887 BTC
 
 To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
 
+HOP 2
+f37419c0…eb99d1
+−0.269792 BTC
+From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
+Block 960,669
+
+To bc1qdt6c…srqw
+
 HOP 1
 61c0ddac…98c095
 −0.509799 BTC
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
 
+HOP 2
+49dd2935…d49564
+−0.24 BTC
+From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
+Block 960,668
+
+To bc1qprkj…jr98
+
 ff327937…abc133
 −0.50980268 BTC
 From Evening vault bc1q7rms…rcgf
 Block 960,663
 
 To 3P3K2MQw…Lfgy
+
+HOP 2
+d0bcdc4a…33c0a0
+−0.24134867 BTC
+From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
+Block 960,661
+
+To P2SH service hub 3KMmeqPe…qtc8
 
 5ecc3052…a8bf87
 −0.69135523 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,087,126

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,269,030
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,872,793
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  56. source content difference between and source content +40 -157

    The tracker reported a second CoinJoin for the Aug. 2 vault residual, relabelled several P2TR transfers, and removed an Arkham attribution.

    seen · Captured here 25,982 chars
    What changed from the previous capture 197 lines 
     
 LAST MOVEMENT
 
-Block 961,075
-
-0.00544006 BTC from Hop 1 from P2TR vault
+Block 961,069
+
+64.90373154 BTC from Hop 1 from Aug 2 vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382, base-3 denoms; likely Wasabi 2 — f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC still at bc1qajcr….
+Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382; f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC at bc1qajcr…. Residual re-entered a second CJ (mempool, ~2 sat/vB, 320→374; 3bdac8ed…cdf935): equal denoms (1 / 0.3355 / 0.2 / …) + new residual ~47.12 BTC at bc1qq6s7…. No exchange exit yet.
 	bc1q0rvn88…jf5q6m	0.00 BTC
 <live-fiat-value>
 	64.90373764 BTC	0	EMPTIED
 
 AUG 4 CASH-OUT · LATER P2TR VAULT (~10.45)
 
-~0.01→hop bc1qqa7p9… · 961019 · 780ea043…cf0326
-~1.00→hop bc1qqa7p9… · 961021 · 064eb61d…7ddd4f
-~2.00→hop bc1q2nfx… · 961026 · 1a454301…c772c2
-~1.00→hop bc1qqa7p9… · 961032 · 2c7075a3…5012cc
-~2.00→hop bc1q2nfx… · 961037 · 92718385…cac6b9
+~0.01→OP_RETURN messenger hub · 961019 · 780ea043…cf0326
+~1.00→OP_RETURN messenger hub · 961021 · 064eb61d…7ddd4f
+~2.00→OP_RETURN messenger hub · 961026 · 1a454301…c772c2
+~1.00→OP_RETURN messenger hub · 961032 · 2c7075a3…5012cc
+~2.00→OP_RETURN messenger hub · 961037 · 92718385…cac6b9
 ~4.44→Taproot park (still held) · 961048 · d969fd1c…7e16ef
 
 Then via hop hubs (commingled) → Binance
 	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
-Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 342L6n3b… + 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window — Arkham unlabeled, no exchange exit yet.
+Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 342L6n3b… + 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window.
 	35dHFzKHn4…X4wNxH	0.00 BTC
 <live-fiat-value>
 	2.17767618 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
-
-HOP 1
-34858588…e8c4df
-−0.00061033 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To bc1qml22…us8p
-
-HOP 1
-4cde11d6…6bebb4
-−0.00043723 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To bc1q3dwq…d3xz
-
-HOP 1
-637a832f…ed934b
-−0.0002598 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To bc1qzrks…s0zj
-
-HOP 1
-96400681…fcf595
-−0.33149475 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To OP_RETURN messenger hub bc1qesrv…d78w
-
-HOP 1
-e6801737…285f61
-−0.51781432 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To bc1qvau7…wpxy
-
-HOP 1
-faf354d1…950cd2
-−0.00076366 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
-
-To bc1qh4cy…kqd9
 
 HOP 2
 3bdac8ed…cdf935
 To bc1qq6s7…y2fr, bc1qp9cn…vyzf, bc1qsp57…c4ad +371 more
 
 HOP 1
-5d54d965…b1a28a
-−0.00544006 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,075
-
-To bc1q829y…dsqn
-
-HOP 1
 f3ee6e61…c37b24
 −64.90373154 BTC
 From Hop 1 from Aug 2 vault bc1pynd6…7h92
 
 To 334iKwmh…J6gB
 
-HOP 1
-1e96c88b…91ab3a
-−0.33330008 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,059
-
-To OP_RETURN messenger hub bc1qesrv…d78w
-
-HOP 1
-34d1450a…bb592b
-−0.33307481 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,058
-
-To OP_RETURN messenger hub bc1qesrv…d78w
-
-HOP 1
-3a1941c2…ffe8ae
-−0.00009669 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,058
-
-To bc1qkzvm…7h6s
-
-HOP 1
-bebfb05f…710826
-−1.12722763 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,058
-
-To bc1q684n…gf0u
-
-HOP 1
-400a609f…5faae2
-−0.00155178 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,057
-
-To bc1qgw9v…y7ql
-
-HOP 1
-8fc1b8ad…85334d
-−0.00024622 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,057
-
-To bc1q7hcw…aaqs
-
-HOP 1
-d73ac571…1d3c29
-−0.00031385 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,057
-
-To bc1qrp6u…n2up
-
-HOP 1
-67269902…8ce3fe
-−0.33310015 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,056
-
-To OP_RETURN messenger hub bc1qesrv…d78w
-
-HOP 1
-8f741f45…1f5453
-−0.33351502 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,056
-
-To OP_RETURN messenger hub bc1qesrv…d78w
+f02164a9…0db281
+−0.96227191 BTC
+From Wave 4 park 34nHYNnc…4qDQ
+Block 961,064
+
+To 334iKwmh…J6gB
 
 d969fd1c…7e16ef
 −4.43721266 BTC
 
 To bc1prjnv…prpr
 
-HOP 1
-cecd3aa5…b4f0e2
-−0.00048106 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,044
-
-To bc1qhp93…kwz2
-
 92718385…cac6b9
 −2.00018023 BTC
 From P2TR vault bc1p0l0x…lk0h
 From P2TR vault bc1p0l0x…lk0h
 Block 961,032
 
-To bc1qqa7p…36pr
+To OP_RETURN messenger hub bc1qqa7p…36pr
 
 1a454301…c772c2
 −2.00017714 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,021
 
-To bc1qqa7p…36pr
+To OP_RETURN messenger hub bc1qqa7p…36pr
 
 780ea043…cf0326
 −0.01017904 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,019
 
-To bc1qqa7p…36pr
+To OP_RETURN messenger hub bc1qqa7p…36pr
+
+HOP 2
+822230d2…e3083a
+−0.47797906 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
+Block 960,832
+
+To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
 
 HOP 1
 15d1287d…e9bdf0
 
 To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
 
-HOP 2
-24ed08ad…a7f583
-−4.27762101 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
-Block 960,797
-
-To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
-
 HOP 1
 6c85668e…d30bbb
 −0.02374887 BTC
 Block 960,666
 
 To bc1qu2uq…6srw
+
+HOP 2
+3cf126ca…10ae88
+−0.44999667 BTC
+From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
+Block 960,666
+
+To P2SH service hub 3KMmeqPe…qtc8
 
 HOP 1
 a7bf30f0…92fdec
 BEYOND THE MAIN SEED
 Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. Still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. CK tripwire is mapping live how far added dice/passphrase entropy currently stops sweeps (zero-entropy control swept in ~1h; low-band honeypots still live as of Aug 4). Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 
 Aug 4: ≥15 attackers (footprints A–O). Overnight footprint O ~12 BTC from 126 addresses from one victim report; no public address list yet.
 
+James O'Beirne · CK tripwire
+
+Aug 4: live honeypot scoreboard mapping attacker brute-force depth via decoys with added dice/passphrase entropy (cktripwire.com; announcement). Zero-entropy control swept in ~1h; low-band (11–13 bit) honeypots still live at launch. Defensive research only — do not add honeypot sinks to holdings.
+
 Galaxy Research · Wave 3
 
 Aug 1: third wave (~207.73 BTC into 293 P2WSH vaults). Observed total 1,367.05 BTC across 4,585 addresses.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,429,564

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,461,741
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,886,349
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  57. source content difference between and source content +94 -95

    The tracker added new unconfirmed hop movements from the P2TR vault and revised its movement feed.

    seen · Captured here 27,054 chars
    What changed from the previous capture 189 lines 
     Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 1
+34858588…e8c4df
+−0.00061033 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qml22…us8p
+
+HOP 1
+4cde11d6…6bebb4
+−0.00043723 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1q3dwq…d3xz
+
+HOP 1
+637a832f…ed934b
+−0.0002598 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qzrks…s0zj
+
+HOP 1
+96400681…fcf595
+−0.33149475 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To OP_RETURN messenger hub bc1qesrv…d78w
+
+HOP 1
+e6801737…285f61
+−0.51781432 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qvau7…wpxy
+
+HOP 1
+faf354d1…950cd2
+−0.00076366 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qh4cy…kqd9
+
+HOP 2
+3bdac8ed…cdf935
+−54.31783009 BTC
+From Hop 2 from Hop 1 from Aug 2 vault bc1qajcr…2d3t
+Unconfirmed
+
+To bc1qq6s7…y2fr, bc1qp9cn…vyzf, bc1qsp57…c4ad +371 more
+
+HOP 1
 5d54d965…b1a28a
 −0.00544006 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 
 To 334iKwmh…J6gB
 
-f02164a9…0db281
-−0.96227191 BTC
-From Wave 4 park 34nHYNnc…4qDQ
-Block 961,064
-
-To 334iKwmh…J6gB
-
 HOP 1
 1e96c88b…91ab3a
 −0.33330008 BTC
 
 To bc1qqa7p…36pr
 
-HOP 1
-d37d6901…bac7b6
-−0.00061835 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qkg64…xygt
-
-HOP 1
-ee4e4c70…2105f2
-−0.00282469 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qz9hf…97s0
-
-HOP 1
-58932a6d…7eb177
-−0.229641 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1q080c…wua8
-
-HOP 1
-d58b2c53…3d82a4
-−0.25476269 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1qqm62…efvn
-
-HOP 1
-00987d33…2e738f
-−0.00231734 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qt6f9…8tfz
-
-HOP 1
-204afe34…a3203b
-−0.27432425 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qqm62…efvn
-
-HOP 1
-8458986a…c9d375
-−0.00022475 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qddn8…ucc7
-
-HOP 1
-ed2daae8…4e77ff
-−0.00309258 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1q2tj0…lj63
-
 1a454301…c772c2
 −2.00017714 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,026
 
 To OP_RETURN messenger hub bc1q2nfx…kyyq
-
-HOP 1
-03d7ba76…5a2320
-−0.00304252 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1qvr9d…85ay
-
-HOP 1
-8c8cd809…92b614
-−0.0030229 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1q987r…al70
-
-HOP 1
-af2216ea…106397
-−0.04560948 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1q5cyd…jsyq
 
 064eb61d…7ddd4f
 −1.00017823 BTC
 Block 960,793
 
 To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
+
+HOP 1
+61c0ddac…98c095
+−0.509799 BTC
+From Hop 1 from Evening vault bc1qu2uq…6srw
+Block 960,668
+
+To bc1qt8ca…5y4k, bc1qzkap…6e4z
+
+ff327937…abc133
+−0.50980268 BTC
+From Evening vault bc1q7rms…rcgf
+Block 960,666
+
+To bc1qu2uq…6srw
+
+HOP 1
+a7bf30f0…92fdec
+−0.45 BTC
+From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
+Block 960,663
+
+To 3P3K2MQw…Lfgy
+
+5ecc3052…a8bf87
+−0.69135523 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Block 960,658
+
+To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,675,812

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,600,321
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,896,098
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  58. source content difference between and source content +95 -38

    The tracker restored and added several historical Wave 4 and P2TR-vault movements, while removing several older hop entries.

    seen · Captured here 26,966 chars
    What changed from the previous capture 133 lines 
     
 To 334iKwmh…J6gB
 
+f02164a9…0db281
+−0.96227191 BTC
+From Wave 4 park 34nHYNnc…4qDQ
+Block 961,064
+
+To 334iKwmh…J6gB
+
 HOP 1
 1e96c88b…91ab3a
 −0.33330008 BTC
 
 To bc1qqa7p…36pr
 
+HOP 1
+d37d6901…bac7b6
+−0.00061835 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qkg64…xygt
+
+HOP 1
+ee4e4c70…2105f2
+−0.00282469 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qz9hf…97s0
+
+HOP 1
+58932a6d…7eb177
+−0.229641 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1q080c…wua8
+
+HOP 1
+d58b2c53…3d82a4
+−0.25476269 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1qqm62…efvn
+
+HOP 1
+00987d33…2e738f
+−0.00231734 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qt6f9…8tfz
+
+HOP 1
+204afe34…a3203b
+−0.27432425 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qqm62…efvn
+
+HOP 1
+8458986a…c9d375
+−0.00022475 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qddn8…ucc7
+
+HOP 1
+ed2daae8…4e77ff
+−0.00309258 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1q2tj0…lj63
+
 1a454301…c772c2
 −2.00017714 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,026
 
 To OP_RETURN messenger hub bc1q2nfx…kyyq
+
+HOP 1
+03d7ba76…5a2320
+−0.00304252 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1qvr9d…85ay
+
+HOP 1
+8c8cd809…92b614
+−0.0030229 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1q987r…al70
+
+HOP 1
+af2216ea…106397
+−0.04560948 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1q5cyd…jsyq
 
 064eb61d…7ddd4f
 −1.00017823 BTC
 Block 960,793
 
 To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
-
-HOP 1
-61c0ddac…98c095
-−0.509799 BTC
-From Hop 1 from Evening vault bc1qu2uq…6srw
-Block 960,668
-
-To bc1qt8ca…5y4k, bc1qzkap…6e4z
-
-ff327937…abc133
-−0.50980268 BTC
-From Evening vault bc1q7rms…rcgf
-Block 960,666
-
-To bc1qu2uq…6srw
-
-HOP 1
-a7bf30f0…92fdec
-−0.45 BTC
-From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
-Block 960,663
-
-To 3P3K2MQw…Lfgy
-
-5ecc3052…a8bf87
-−0.69135523 BTC
-From Aug 1 hop vault bc1qayw8…2u0s
-Block 960,658
-
-To bc1qsd9t…jah8, bc1qvrpc…cddc
-
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,439,183

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,467,155
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,886,730
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  59. source content difference between and source content +90 -149

    The tracker added a 0.00544006 BTC movement, revised destination labels, and removed several previously listed movements.

    seen · Captured here 26,208 chars
    What changed from the previous capture 239 lines 
     
 LAST MOVEMENT
 
-Block 961,069
-
-64.90373154 BTC from Hop 1 from Aug 2 vault
+Block 961,075
+
+0.00544006 BTC from Hop 1 from P2TR vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382, base-3 denoms; likely Wasabi 2 — f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC still at bc1qajcr…. No Arkham entity / exchange label; not added to KNOWN_ADDRESS_LABELS.
+Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382, base-3 denoms; likely Wasabi 2 — f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC still at bc1qajcr….
 	bc1q0rvn88…jf5q6m	0.00 BTC
 <live-fiat-value>
 	64.90373764 BTC	0	EMPTIED
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 1
+5d54d965…b1a28a
+−0.00544006 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,075
+
+To bc1q829y…dsqn
+
+HOP 1
 f3ee6e61…c37b24
 −64.90373154 BTC
 From Hop 1 from Aug 2 vault bc1pynd6…7h92
 
 To 334iKwmh…J6gB
 
-f02164a9…0db281
-−0.96227191 BTC
-From Wave 4 park 34nHYNnc…4qDQ
-Block 961,064
-
-To 334iKwmh…J6gB
-
 HOP 1
 1e96c88b…91ab3a
 −0.33330008 BTC
 To bc1qkzvm…7h6s
 
 HOP 1
-995b19ad…8ebed0
-−0.00251659 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,058
-
-To bc1qp75g…xkdv
-
-HOP 1
 bebfb05f…710826
 −1.12722763 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 
 To OP_RETURN messenger hub bc1qesrv…d78w
 
-HOP 1
-156e7ebd…f58a90
-−0.00309444 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,053
-
-To bc1qtmx2…a6mw
-
-HOP 1
-00b19966…6bd9e8
-−0.02053703 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1pmmdj…mc5l
-
-HOP 1
-05f6c636…a8914d
-−0.00103649 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1q7ynw…wu87
-
-HOP 1
-1ced4a91…aec1ed
-−0.00004363 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1qrznn…hpsn
-
-HOP 1
-2eb81dde…e952f0
-−0.00887704 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1qk5jr…gwsy
-
-HOP 1
-459f4a50…4d5c22
-−0.00650228 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1qff77…pwq3
-
-HOP 1
-e36fd520…cf0737
-−0.00154315 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1qemv6…72jc
-
-HOP 1
-f051363a…4c2b43
-−0.03543438 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,052
-
-To bc1q2ckk…6gam
-
-HOP 1
-d89884fa…b6242a
-−0.1683704 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,051
-
-To bc1qjwsu…60sm
-
-HOP 1
-dcd0a3c4…3bfc27
-−0.00231655 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,051
-
-To bc1qss8u…g8de
-
-HOP 1
-1d357178…1a7861
-−0.00220154 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,050
-
-To bc1qj4ap…f0dq
-
-HOP 1
-36579618…2397a5
-−0.00235884 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,050
-
-To bc1qtnuk…0ml8
-
-HOP 1
-5f8c69df…a29fe8
-−0.00008608 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,050
-
-To bc1qg69q…gwzf
-
 d969fd1c…7e16ef
 −4.43721266 BTC
 From P2TR vault bc1p0l0x…lk0h
 To bc1prjnv…prpr
 
 HOP 1
-01dddbcc…1ada41
-−0.00741923 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,048
-
-To bc1qkyer…y336
-
-HOP 1
-44caa445…48f3ee
-−0.03848897 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,048
-
-To bc1qmxc0…4ne6
-
-HOP 1
-d6c15cd4…b280cc
-−0.0070087 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,048
-
-To bc1q67pj…3drp
-
-HOP 1
 cecd3aa5…b4f0e2
 −0.00048106 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 From P2TR vault bc1p0l0x…lk0h
 Block 961,037
 
-To bc1q2nfx…kyyq
+To OP_RETURN messenger hub bc1q2nfx…kyyq
 
 2c7075a3…5012cc
 −1.00017899 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,026
 
-To bc1q2nfx…kyyq
+To OP_RETURN messenger hub bc1q2nfx…kyyq
 
 064eb61d…7ddd4f
 −1.00017823 BTC
 Block 960,822
 
 To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
+
+23a84f33…bc709c
+−2.81971503 BTC
+From Wave 4 park 1N8knQCf…qfDo
+Block 960,818
+
+To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
+
+HOP 2
+24ed08ad…a7f583
+−4.27762101 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
+Block 960,797
+
+To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
+HOP 1
+6c85668e…d30bbb
+−0.02374887 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
+
+HOP 1
+6c85668e…d30bbb
+−0.06990788 BTC
+From Hop 1 from Wave 4 park bc1qw79v…83ha
+Block 960,794
+
+To bc1qhfdz…3wcx
+
+6f19b1b9…fdd235
+−2.79332251 BTC
+From Wave 4 park 1N8knQCf…qfDo
+Block 960,793
+
+To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
+
+HOP 1
+61c0ddac…98c095
+−0.509799 BTC
+From Hop 1 from Evening vault bc1qu2uq…6srw
+Block 960,668
+
+To bc1qt8ca…5y4k, bc1qzkap…6e4z
+
+ff327937…abc133
+−0.50980268 BTC
+From Evening vault bc1q7rms…rcgf
+Block 960,666
+
+To bc1qu2uq…6srw
+
+HOP 1
+a7bf30f0…92fdec
+−0.45 BTC
+From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
+Block 960,663
+
+To 3P3K2MQw…Lfgy
+
+5ecc3052…a8bf87
+−0.69135523 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Block 960,658
+
+To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,410,326

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,450,915
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,885,588
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  60. source content difference between and source content +5 -5

    The tracker added CoinJoin detail for the Aug. 2 vault movement and labeled several destinations as OP_RETURN messenger hubs.

    seen · Captured here 26,854 chars
    What changed from the previous capture 10 lines 
     LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… still holding ~64.90 BTC (e3274a1b…2b3ddf). No exchange label yet.
+Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… (e3274a1b…2b3ddf). Hop emptied same day in Wasabi-style CoinJoin (block 961069, ~2 sat/vB, 324→382, base-3 denoms; likely Wasabi 2 — f3ee6e61…7b24): equal ~1.2914 BTC outs ×20 + residual ~54.32 BTC still at bc1qajcr…. No Arkham entity / exchange label; not added to KNOWN_ADDRESS_LABELS.
 	bc1q0rvn88…jf5q6m	0.00 BTC
 <live-fiat-value>
 	64.90373764 BTC	0	EMPTIED
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 Block 961,059
 
-To bc1qesrv…d78w
+To OP_RETURN messenger hub bc1qesrv…d78w
 
 HOP 1
 34d1450a…bb592b
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 Block 961,058
 
-To bc1qesrv…d78w
+To OP_RETURN messenger hub bc1qesrv…d78w
 
 HOP 1
 3a1941c2…ffe8ae
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 Block 961,056
 
-To bc1qesrv…d78w
+To OP_RETURN messenger hub bc1qesrv…d78w
 
 HOP 1
 8f741f45…1f5453
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 Block 961,056
 
-To bc1qesrv…d78w
+To OP_RETURN messenger hub bc1qesrv…d78w
 
 HOP 1
 156e7ebd…f58a90
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,698,897

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,613,312
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,897,012
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  61. source content difference between and source content +60 -58

    The tracker recorded a 64.90373154 BTC CoinJoin movement from the Aug. 2 vault and updated watched-holdings and Wave 4 movement records.

    seen · Captured here 26,537 chars
    What changed from the previous capture 118 lines 
     
 STILL HELD
 
-94.2%
-
-of 1,483.59806802 BTC consolidated
+94.0%
+
+of 1,485.7757442 BTC consolidated
 
 MOVED
 
-86.24572213 BTC
+88.42339831 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,065
-
-64.90373764 BTC from Aug 2 vault
+Block 961,069
+
+64.90373154 BTC from Hop 1 from Aug 2 vault
 
 Watched holdings
 
-About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 3 high-confidence headline is 1,596.00 BTC across ~7,300 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,055.00 BTC if candidate Wave 4 is included. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now estimates ≥15 attackers.
+About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 3 high-confidence headline is 1,596.00 BTC across ~7,300 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,055.00 BTC if candidate Wave 4 is included. 1,485.7757442 BTC is in watched holdings. The remaining ~438.03173705 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now estimates ≥15 attackers.
 
 GALAXY WAVE 1 · JULY 30
 Source
 	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
-Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window — Arkham unlabeled, no exchange exit yet.
+Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 342L6n3b… + 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window — Arkham unlabeled, no exchange exit yet.
+	35dHFzKHn4…X4wNxH	0.00 BTC
+<live-fiat-value>
+	2.17767618 BTC	0	EMPTIED
+
+Wave 4 park
+Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
 	342L6n3b61…TSjZtz	0.00 BTC
 <live-fiat-value>
 	2.02374869 BTC	0	EMPTIED
 	1.14852067 BTC	1	HELD
 
 Wave 4 park
-Emptied Aug 4 (block 961064): same 14-input consolidate as 342L6n3b… → 334iKwmh… (~136.41 BTC still held).
+Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
 	36XfMDAYuC…1F1x3G	0.00 BTC
 <live-fiat-value>
 	1.09429601 BTC	0	EMPTIED
 	1.03514173 BTC	1	HELD
 
 Wave 4 park
-Emptied Aug 4 (block 961064): same 14-input consolidate as 342L6n3b… → 334iKwmh… (~136.41 BTC still held).
+Emptied Aug 4 (block 961064): same 14-input consolidate as 35dHFzKH… → 334iKwmh… (~136.41 BTC still held).
 	34nHYNnc9D…jP4qDQ	0.00 BTC
 <live-fiat-value>
 	0.96227191 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 1
+f3ee6e61…c37b24
+−64.90373154 BTC
+From Hop 1 from Aug 2 vault bc1pynd6…7h92
+Block 961,069
+
+To bc1qajcr…2d3t, bc1qrrx3…hy4j, bc1qyzsq…qvdx +379 more
 
 e3274a1b…2b3ddf
 −64.90373764 BTC
 To bc1pynd6…7h92
 
 f02164a9…0db281
+−2.17767618 BTC
+From Wave 4 park 35dHFzKH…wNxH
+Block 961,064
+
+To 334iKwmh…J6gB
+
+f02164a9…0db281
 −2.02374869 BTC
 From Wave 4 park 342L6n3b…jZtz
 Block 961,064
 To bc1qmxc0…4ne6
 
 HOP 1
-65d43b31…a3192b
-−0.00692653 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,048
-
-To bc1qnnfx…v8pz
-
-HOP 1
 d6c15cd4…b280cc
 −0.0070087 BTC
 From Hop 1 from P2TR vault bc1q2nfx…kyyq
 Block 961,048
 
 To bc1q67pj…3drp
-
-HOP 1
-6baa09bc…294c5b
-−0.03611606 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,047
-
-To bc1q2gpn…p2a6
 
 HOP 1
 cecd3aa5…b4f0e2
 
 To bc1qqa7p…36pr
 
-HOP 1
-d37d6901…bac7b6
-−0.00061835 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qkg64…xygt
-
-HOP 1
-ee4e4c70…2105f2
-−0.00282469 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qz9hf…97s0
-
-HOP 1
-58932a6d…7eb177
-−0.229641 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1q080c…wua8
-
-HOP 1
-d58b2c53…3d82a4
-−0.25476269 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1qqm62…efvn
+1a454301…c772c2
+−2.00017714 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,026
+
+To bc1q2nfx…kyyq
+
+064eb61d…7ddd4f
+−1.00017823 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,021
+
+To bc1qqa7p…36pr
+
+780ea043…cf0326
+−0.01017904 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,019
+
+To bc1qqa7p…36pr
+
+HOP 1
+15d1287d…e9bdf0
+−0.50633044 BTC
+From Hop 1 from Wave 4 park bc1qa2xv…c3y9
+Block 960,822
+
+To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,698,897

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,613,312
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,897,012
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  62. source content difference between and source content +94 -96

    The tracker updated its displayed balance totals and transaction trail as monitored funds moved.

    seen · Captured here 26,322 chars
    What changed from the previous capture 190 lines 
     
 BALANCE ON WATCH
 
-1,466.33640014 BTC
+1,397.35234589 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 STILL HELD
 
-98.8%
+94.2%
 
 of 1,483.59806802 BTC consolidated
 
 MOVED
 
-17.26166788 BTC
+86.24572213 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,060
-
-1.6670576 BTC from Hop 2 from Hop 1 from P2TR vault
+Block 961,065
+
+64.90373764 BTC from Aug 2 vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 2 vault
-	bc1q0rvn88…jf5q6m	64.90373764 BTC
-<live-fiat-value>
-	64.90373764 BTC	1	HELD
+Emptied Aug 4 (block 961065, ~5 sat/vB): bc1q0rvn… → Taproot hop bc1pynd6… still holding ~64.90 BTC (e3274a1b…2b3ddf). No exchange label yet.
+	bc1q0rvn88…jf5q6m	0.00 BTC
+<live-fiat-value>
+	64.90373764 BTC	0	EMPTIED
 P2TR WAVE · AUG 1–3
 Source
 
 	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
-	342L6n3b61…TSjZtz	2.02374869 BTC
-<live-fiat-value>
-	2.02374869 BTC	1	HELD
+Emptied Aug 4 (block 961064, ~2 sat/vB): 14-input P2SH consolidate with sibling parks → 334iKwmh… still holding ~136.41 BTC (f02164a9…50db281). Same tx as 36XfMDAYu… + 34nHYNnc…. Mix includes parks funded outside Wave 4 window — Arkham unlabeled, no exchange exit yet.
+	342L6n3b61…TSjZtz	0.00 BTC
+<live-fiat-value>
+	2.02374869 BTC	0	EMPTIED
 
 Wave 4 park
 	bc1q65e6cd…yce9u8	1.14852067 BTC
 	1.14852067 BTC	1	HELD
 
 Wave 4 park
-	36XfMDAYuC…1F1x3G	1.09429601 BTC
-<live-fiat-value>
-	1.09429601 BTC	1	HELD
+Emptied Aug 4 (block 961064): same 14-input consolidate as 342L6n3b… → 334iKwmh… (~136.41 BTC still held).
+	36XfMDAYuC…1F1x3G	0.00 BTC
+<live-fiat-value>
+	1.09429601 BTC	0	EMPTIED
 
 Wave 4 park
 	bc1qcmnjt0…rfjvtl	1.04998888 BTC
 	1.03514173 BTC	1	HELD
 
 Wave 4 park
-	34nHYNnc9D…jP4qDQ	0.96227191 BTC
-<live-fiat-value>
-	0.96227191 BTC	1	HELD
+Emptied Aug 4 (block 961064): same 14-input consolidate as 342L6n3b… → 334iKwmh… (~136.41 BTC still held).
+	34nHYNnc9D…jP4qDQ	0.00 BTC
+<live-fiat-value>
+	0.96227191 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
-HOP 2
-e685505b…414b8f
-−1.6670576 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,060
-
-To 153La7Fb…Wmav
+e3274a1b…2b3ddf
+−64.90373764 BTC
+From Aug 2 vault bc1q0rvn…5q6m
+Block 961,065
+
+To bc1pynd6…7h92
+
+f02164a9…0db281
+−2.02374869 BTC
+From Wave 4 park 342L6n3b…jZtz
+Block 961,064
+
+To 334iKwmh…J6gB
+
+f02164a9…0db281
+−1.09429601 BTC
+From Wave 4 park 36XfMDAY…1x3G
+Block 961,064
+
+To 334iKwmh…J6gB
+
+f02164a9…0db281
+−0.96227191 BTC
+From Wave 4 park 34nHYNnc…4qDQ
+Block 961,064
+
+To 334iKwmh…J6gB
 
 HOP 1
 1e96c88b…91ab3a
 
 To bc1qrp6u…n2up
 
-HOP 2
-804eb231…e29116
-−1.25404944 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,057
-
-To 153La7Fb…Wmav
-
 HOP 1
 67269902…8ce3fe
 −0.33310015 BTC
 
 To bc1qesrv…d78w
 
-HOP 2
-9ef38b2b…01f97d
-−1.33704944 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,054
-
-To 153La7Fb…Wmav
-
 HOP 1
 156e7ebd…f58a90
 −0.00309444 BTC
 Block 961,052
 
 To bc1q2ckk…6gam
-
-HOP 2
-5667309b…44dd39
-−1.11004128 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,052
-
-To 153La7Fb…Wmav
 
 HOP 1
 d89884fa…b6242a
 To bc1q2gpn…p2a6
 
 HOP 1
-fcda8404…846909
-−0.02158849 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,047
-
-To bc1qvvrh…0sc0
-
-HOP 2
-44cb36ab…272c4f
-−1.00404128 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,047
-
-To 153La7Fb…Wmav
-
-HOP 2
-9d509867…59f590
-−0.29900645 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qqm62…efvn
-Block 961,047
-
-To bc1q9r83…k0sw
-
-HOP 1
-1c09bf59…af961f
-−1.81206797 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,046
-
-To Binance deposit 199JVFuJ…2GwG
-
-HOP 1
-57a9d5f2…7c90bc
-−2.42609494 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,046
-
-To Binance deposit 14ajEkhP…tsxR
-
-HOP 1
 cecd3aa5…b4f0e2
 −0.00048106 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 
 To bc1qhp93…kwz2
 
-HOP 1
-78bbac1c…f3d60c
-−0.00310542 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,043
-
-To bc1qmpj5…rk2c
+92718385…cac6b9
+−2.00018023 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,037
+
+To bc1q2nfx…kyyq
+
+2c7075a3…5012cc
+−1.00017899 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,032
+
+To bc1qqa7p…36pr
+
+HOP 1
+d37d6901…bac7b6
+−0.00061835 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qkg64…xygt
+
+HOP 1
+ee4e4c70…2105f2
+−0.00282469 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qz9hf…97s0
+
+HOP 1
+58932a6d…7eb177
+−0.229641 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1q080c…wua8
+
+HOP 1
+d58b2c53…3d82a4
+−0.25476269 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1qqm62…efvn
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,079,431

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,264,699
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,872,488
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  63. source content difference between and source content +72 -69

    The tracker updated its displayed balance totals and transaction trail as monitored funds moved.

    seen · Captured here 25,949 chars
    What changed from the previous capture 141 lines 
     
 BALANCE ON WATCH
 
-1,466.33639014 BTC
+1,466.33640014 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-17.26167788 BTC
+17.26166788 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,056
-
-0.33310015 BTC from Hop 1 from P2TR vault
+Block 961,060
+
+1.6670576 BTC from Hop 2 from Hop 1 from P2TR vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02076435 BTC
-<live-fiat-value>
-	562.02021083 BTC	32	HELD
+	bc1qq85v2c…3fcu9r	562.02077435 BTC
+<live-fiat-value>
+	562.02021083 BTC	33	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 2 vault
-Consolidated from 1,216 sweeps (via bc1qsjrf5ze…)
+Consolidated from 1,216 sweeps (via bc1qsjrf5ze…). Chainabuse victim on that sweep sink.
 	bc1qtfrwa4…numu75	45.90252994 BTC
 <live-fiat-value>
 	45.90251994 BTC	2	HELD
 
 Wave 2 collector
-Unmoved collector from 93 sweeps at ~10 sat/vB
+Unmoved collector from 93 sweeps at ~10 sat/vB. Chainabuse victim.
 	bc1qmd5m5k…9n8jp6	30.18477329 BTC
 <live-fiat-value>
 	30.18476329 BTC	94	HELD
 	5.39098601 BTC	1	HELD
 
 Wave 3 vault 7
+Chainabuse victim · Mk3 drain (park → this vault).
 	bc1qtsp50w…pf73yt	4.53878769 BTC
 <live-fiat-value>
 	4.53878769 BTC	1	HELD
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Jul 31 consolidation (~0.51 BTC). Emptied Aug 2–3 (ETH + BTC rails above).
+Jul 31 consolidation (~0.51 BTC). Emptied Aug 2–3 (ETH + BTC rails above). Chainabuse victim.
 	bc1q7rmsw0…lrrcgf	0.00 BTC
 <live-fiat-value>
 	0.50980268 BTC	0	EMPTIED
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
+HOP 2
+e685505b…414b8f
+−1.6670576 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Block 961,060
+
+To 153La7Fb…Wmav
+
+HOP 1
+1e96c88b…91ab3a
+−0.33330008 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,059
+
+To bc1qesrv…d78w
+
+HOP 1
+34d1450a…bb592b
+−0.33307481 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,058
+
+To bc1qesrv…d78w
+
+HOP 1
+3a1941c2…ffe8ae
+−0.00009669 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,058
+
+To bc1qkzvm…7h6s
+
+HOP 1
+995b19ad…8ebed0
+−0.00251659 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,058
+
+To bc1qp75g…xkdv
+
+HOP 1
+bebfb05f…710826
+−1.12722763 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,058
+
+To bc1q684n…gf0u
+
 HOP 1
 400a609f…5faae2
 −0.00155178 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
+Block 961,057
 
 To bc1qgw9v…y7ql
 
 8fc1b8ad…85334d
 −0.00024622 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
+Block 961,057
 
 To bc1q7hcw…aaqs
 
 d73ac571…1d3c29
 −0.00031385 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
-Unconfirmed
+Block 961,057
 
 To bc1qrp6u…n2up
 
 804eb231…e29116
 −1.25404944 BTC
 From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Unconfirmed
+Block 961,057
 
 To 153La7Fb…Wmav
 
 
 To 153La7Fb…Wmav
 
+HOP 2
+9d509867…59f590
+−0.29900645 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qqm62…efvn
+Block 961,047
+
+To bc1q9r83…k0sw
+
 HOP 1
 1c09bf59…af961f
 −1.81206797 BTC
 Block 961,043
 
 To bc1qmpj5…rk2c
-
-HOP 1
-e284daf5…8ac33d
-−0.00098663 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,039
-
-To bc1qcamh…mwf7
-
-92718385…cac6b9
-−2.00018023 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,037
-
-To bc1q2nfx…kyyq
-
-2c7075a3…5012cc
-−1.00017899 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,032
-
-To bc1qqa7p…36pr
-
-HOP 1
-d37d6901…bac7b6
-−0.00061835 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qkg64…xygt
-
-HOP 1
-ee4e4c70…2105f2
-−0.00282469 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,030
-
-To bc1qz9hf…97s0
-
-HOP 1
-58932a6d…7eb177
-−0.229641 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1q080c…wua8
-
-HOP 1
-d58b2c53…3d82a4
-−0.25476269 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,028
-
-To bc1qqm62…efvn
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,666,193

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,594,907
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,895,717
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  64. source content difference between and source content +233 -216

    The tracker added a cash-out trail for the later P2TR vault and updated the latest movement.

    seen · Captured here 25,745 chars
    What changed from the previous capture 449 lines 
     
 LAST MOVEMENT
 
-Block 961,046
-
-1.81206797 BTC from Hop 1 from P2TR vault
+Block 961,056
+
+0.33310015 BTC from Hop 1 from P2TR vault
 
 Watched holdings
 
 	36.01585057 BTC	1	HELD
 
 P2TR vault
-Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897).
+Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897). Emptied Aug 4 — trail below.
+
+AUG 4 CASH-OUT · LATER P2TR VAULT (~10.45)
+
+~0.01→hop bc1qqa7p9… · 961019 · 780ea043…cf0326
+~1.00→hop bc1qqa7p9… · 961021 · 064eb61d…7ddd4f
+~2.00→hop bc1q2nfx… · 961026 · 1a454301…c772c2
+~1.00→hop bc1qqa7p9… · 961032 · 2c7075a3…5012cc
+~2.00→hop bc1q2nfx… · 961037 · 92718385…cac6b9
+~4.44→Taproot park (still held) · 961048 · d969fd1c…7e16ef
+
+Then via hop hubs (commingled) → Binance
+
+~5.33→Binance deposit · 961034 · 8 peels from bc1q2nfx… (commingled hub) · 0c60a619…5b6850
+~2.43→Binance deposit · 961046 · from bc1q2nfx… change chain · 57a9d5f2…7c90bc
+~1.81→Binance deposit · 961046 · includes vault UTXO taint via prior consolidate · 1c09bf59…af961f
+~5.33→Binance hot · 961043 · 13i9Za… sweep · e8c70a9d…15ce29
 	bc1p0l0xs2…6qlk0h	0.00000872 BTC
 <live-fiat-value>
 	10.44811501 BTC	2	PARTIAL
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
+HOP 1
+400a609f…5faae2
+−0.00155178 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qgw9v…y7ql
+
+HOP 1
+8fc1b8ad…85334d
+−0.00024622 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1q7hcw…aaqs
+
+HOP 1
+d73ac571…1d3c29
+−0.00031385 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Unconfirmed
+
+To bc1qrp6u…n2up
+
+HOP 2
+804eb231…e29116
+−1.25404944 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Unconfirmed
+
+To 153La7Fb…Wmav
+
+HOP 1
+67269902…8ce3fe
+−0.33310015 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,056
+
+To bc1qesrv…d78w
+
+HOP 1
+8f741f45…1f5453
+−0.33351502 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,056
+
+To bc1qesrv…d78w
+
+HOP 2
+9ef38b2b…01f97d
+−1.33704944 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Block 961,054
+
+To 153La7Fb…Wmav
+
+HOP 1
+156e7ebd…f58a90
+−0.00309444 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,053
+
+To bc1qtmx2…a6mw
+
+HOP 1
+00b19966…6bd9e8
+−0.02053703 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1pmmdj…mc5l
+
+HOP 1
+05f6c636…a8914d
+−0.00103649 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1q7ynw…wu87
+
+HOP 1
+1ced4a91…aec1ed
+−0.00004363 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1qrznn…hpsn
+
+HOP 1
+2eb81dde…e952f0
+−0.00887704 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1qk5jr…gwsy
+
+HOP 1
+459f4a50…4d5c22
+−0.00650228 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1qff77…pwq3
+
+HOP 1
+e36fd520…cf0737
+−0.00154315 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1qemv6…72jc
+
+HOP 1
+f051363a…4c2b43
+−0.03543438 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,052
+
+To bc1q2ckk…6gam
+
+HOP 2
+5667309b…44dd39
+−1.11004128 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Block 961,052
+
+To 153La7Fb…Wmav
+
+HOP 1
+d89884fa…b6242a
+−0.1683704 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,051
+
+To bc1qjwsu…60sm
+
+HOP 1
+dcd0a3c4…3bfc27
+−0.00231655 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,051
+
+To bc1qss8u…g8de
+
+HOP 1
+1d357178…1a7861
+−0.00220154 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,050
+
+To bc1qj4ap…f0dq
+
+HOP 1
+36579618…2397a5
+−0.00235884 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,050
+
+To bc1qtnuk…0ml8
+
+HOP 1
+5f8c69df…a29fe8
+−0.00008608 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,050
+
+To bc1qg69q…gwzf
+
 d969fd1c…7e16ef
 −4.43721266 BTC
 From P2TR vault bc1p0l0x…lk0h
-Unconfirmed
+Block 961,048
 
 To bc1prjnv…prpr
+
+HOP 1
+01dddbcc…1ada41
+−0.00741923 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,048
+
+To bc1qkyer…y336
+
+HOP 1
+44caa445…48f3ee
+−0.03848897 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,048
+
+To bc1qmxc0…4ne6
+
+HOP 1
+65d43b31…a3192b
+−0.00692653 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,048
+
+To bc1qnnfx…v8pz
+
+HOP 1
+d6c15cd4…b280cc
+−0.0070087 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,048
+
+To bc1q67pj…3drp
 
 HOP 1
 6baa09bc…294c5b
 −0.03611606 BTC
 From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Unconfirmed
+Block 961,047
 
 To bc1q2gpn…p2a6
 
 fcda8404…846909
 −0.02158849 BTC
 From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Unconfirmed
+Block 961,047
 
 To bc1qvvrh…0sc0
+
+HOP 2
+44cb36ab…272c4f
+−1.00404128 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Block 961,047
+
+To 153La7Fb…Wmav
 
 HOP 1
 1c09bf59…af961f
 From Hop 1 from P2TR vault bc1q2nfx…kyyq
 Block 961,046
 
-To 199JVFuJ…2GwG
+To Binance deposit 199JVFuJ…2GwG
 
 HOP 1
 57a9d5f2…7c90bc
 From Hop 1 from P2TR vault bc1q2nfx…kyyq
 Block 961,046
 
-To 14ajEkhP…tsxR
+To Binance deposit 14ajEkhP…tsxR
 
 HOP 1
 cecd3aa5…b4f0e2
 
 To bc1qmpj5…rk2c
 
-HOP 2
-e8c70a9d…15ce29
-−3.9621219 BTC
-From Hop 2 from Hop 1 from P2TR vault 199JVFuJ…2GwG
-Block 961,043
-
-To bc1qm34l…7s3h
-
-HOP 2
-e8c70a9d…15ce29
-−5.33355387 BTC
-From Hop 2 from Hop 1 from P2TR vault 13i9ZaXB…7vQt
-Block 961,043
-
-To bc1qm34l…7s3h
-
 HOP 1
 e284daf5…8ac33d
 −0.00098663 BTC
 
 To bc1q2nfx…kyyq
 
-HOP 2
-263c9e61…6b330a
-−0.54998482 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qz0zw…2jpd
-Block 961,036
-
-To 3B7LwHkn…puua, bc1qprnf…59c0
-
-HOP 1
-0c60a619…5b6850
-−0.69994653 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-1fe0f9e5…7042f1
-−0.00104176 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To bc1qjlv0…ehrf
-
-HOP 1
-2413c7d9…39c0c0
-−0.69657013 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-432031dc…e14880
-−0.69882107 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-d6f1c564…b12e0f
-−0.70332292 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-d7309842…498bbb
-−0.70107198 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-d95a5204…208ba2
-−0.43400819 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-e18b1027…8206d1
-−0.70219745 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-e7d7b7b2…e20a1e
-−0.00262925 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To bc1q0v7x…ljtq
-
-HOP 1
-ea2d4340…5d97d5
-−0.6976956 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To 13i9ZaXB…7vQt
-
-HOP 1
-f98cec48…be5391
-−0.00077502 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,034
-
-To bc1qagp2…xnm8
-
-HOP 1
-38cb29ff…0cf27b
-−0.3341999 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,033
-
-To bc1qesrv…d78w
-
-HOP 1
-808af84a…48bfe1
-−0.00040225 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,033
-
-To bc1q9497…6kxj
-
-HOP 1
-c3c35ac9…2cb19d
-−0.54999482 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,033
-
-To bc1qz0zw…2jpd
-
 2c7075a3…5012cc
 −1.00017899 BTC
 From P2TR vault bc1p0l0x…lk0h
 Block 961,028
 
 To bc1qqm62…efvn
-
-HOP 1
-00987d33…2e738f
-−0.00231734 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qt6f9…8tfz
-
-HOP 1
-204afe34…a3203b
-−0.27432425 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qqm62…efvn
-
-HOP 1
-8458986a…c9d375
-−0.00022475 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1qddn8…ucc7
-
-HOP 1
-ed2daae8…4e77ff
-−0.00309258 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,027
-
-To bc1q2tj0…lj63
-
-1a454301…c772c2
-−2.00017714 BTC
-From P2TR vault bc1p0l0x…lk0h
-Block 961,026
-
-To bc1q2nfx…kyyq
-
-HOP 1
-03d7ba76…5a2320
-−0.00304252 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1qvr9d…85ay
-
-HOP 1
-8c8cd809…92b614
-−0.0030229 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1q987r…al70
-
-HOP 1
-af2216ea…106397
-−0.04560948 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,025
-
-To bc1q5cyd…jsyq
-
-HOP 1
-1ea85b40…4c37e4
-−0.02282557 BTC
-From Hop 1 from P2TR vault bc1qqa7p…36pr
-Block 961,024
-
-To bc1qvh4u…ahu6
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,741,221

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,637,131
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,898,687
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  65. source content difference between and source content +107 -109

    The tracker updated watched balances and movement records for the later P2TR vault.

    seen · Captured here 24,956 chars
    What changed from the previous capture 216 lines 
     
 BALANCE ON WATCH
 
-1,472.77376765 BTC
+1,466.33639014 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 STILL HELD
 
-99.3%
+98.8%
 
 of 1,483.59806802 BTC consolidated
 
 MOVED
 
-10.82430037 BTC
+17.26167788 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 961,034
-
-0.69994653 BTC from Hop 1 from P2TR vault
+Block 961,046
+
+1.81206797 BTC from Hop 1 from P2TR vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02074897 BTC
-<live-fiat-value>
-	562.02021083 BTC	31	HELD
+	bc1qq85v2c…3fcu9r	562.02076435 BTC
+<live-fiat-value>
+	562.02021083 BTC	32	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 
 P2TR vault
 Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897).
-	bc1p0l0xs2…6qlk0h	6.43740161 BTC
-<live-fiat-value>
-	10.44811501 BTC	128	PARTIAL
+	bc1p0l0xs2…6qlk0h	0.00000872 BTC
+<live-fiat-value>
+	10.44811501 BTC	2	PARTIAL
 LIKELY WAVE 4 · AUG 3
 Source
 
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
+d969fd1c…7e16ef
+−4.43721266 BTC
+From P2TR vault bc1p0l0x…lk0h
+Unconfirmed
+
+To bc1prjnv…prpr
+
+HOP 1
+6baa09bc…294c5b
+−0.03611606 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Unconfirmed
+
+To bc1q2gpn…p2a6
+
+HOP 1
+fcda8404…846909
+−0.02158849 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Unconfirmed
+
+To bc1qvvrh…0sc0
+
+HOP 1
+1c09bf59…af961f
+−1.81206797 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,046
+
+To 199JVFuJ…2GwG
+
+HOP 1
+57a9d5f2…7c90bc
+−2.42609494 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,046
+
+To 14ajEkhP…tsxR
+
+HOP 1
+cecd3aa5…b4f0e2
+−0.00048106 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,044
+
+To bc1qhp93…kwz2
+
+HOP 1
+78bbac1c…f3d60c
+−0.00310542 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,043
+
+To bc1qmpj5…rk2c
+
+HOP 2
+e8c70a9d…15ce29
+−3.9621219 BTC
+From Hop 2 from Hop 1 from P2TR vault 199JVFuJ…2GwG
+Block 961,043
+
+To bc1qm34l…7s3h
+
+HOP 2
+e8c70a9d…15ce29
+−5.33355387 BTC
+From Hop 2 from Hop 1 from P2TR vault 13i9ZaXB…7vQt
+Block 961,043
+
+To bc1qm34l…7s3h
+
+HOP 1
+e284daf5…8ac33d
+−0.00098663 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,039
+
+To bc1qcamh…mwf7
+
+92718385…cac6b9
+−2.00018023 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,037
+
+To bc1q2nfx…kyyq
+
 HOP 2
 263c9e61…6b330a
 −0.54998482 BTC
 From Hop 2 from Hop 1 from P2TR vault bc1qz0zw…2jpd
-Unconfirmed
+Block 961,036
 
 To 3B7LwHkn…puua, bc1qprnf…59c0
 
 To bc1qqa7p…36pr
 
 HOP 1
-1cbcccbd…6aba8c
-−0.10338209 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,032
-
-To bc1qw6sr…vmhg
-
-HOP 1
-3325af44…a9f242
-−0.00185692 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1qctxe…yeq0
-
-HOP 1
-4935ab6d…a6a98c
-−0.00091304 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1qj5vu…c7j8
-
-HOP 1
-aa7c9836…8cf1f7
-−0.00188338 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1qmmd0…x8dy
-
-HOP 1
-bd3e0d1a…f4e1b6
-−0.00009278 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1q88zc…aea4
-
-HOP 1
 d37d6901…bac7b6
 −0.00061835 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 To bc1qkg64…xygt
 
 HOP 1
-d4359621…f65f37
-−0.04268252 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1qcdl5…28p6
-
-HOP 1
 ee4e4c70…2105f2
 −0.00282469 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 To bc1qz9hf…97s0
 
 HOP 1
-f554b1a5…0f670f
-−0.0011621 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1q49ew…wafd
-
-HOP 1
-f9981ae7…960657
-−0.03881964 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,030
-
-To bc1qmj87…rdsd
-
-HOP 1
-12c465e5…f31571
-−0.03762413 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,028
-
-To bc1q882w…py6z
-
-HOP 1
-56de84ef…f20b59
-−0.04034895 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,028
-
-To bc1q8wpl…jz2z
-
-HOP 1
 58932a6d…7eb177
 −0.229641 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 To bc1q080c…wua8
 
 HOP 1
-756c6a12…996ce5
-−0.03298145 BTC
-From Hop 1 from P2TR vault bc1q2nfx…kyyq
-Block 961,028
-
-To bc1q56hf…2eth
-
-HOP 1
 d58b2c53…3d82a4
 −0.25476269 BTC
 From Hop 1 from P2TR vault bc1qqa7p…36pr
 Block 961,027
 
 To bc1q2tj0…lj63
-
-HOP 2
-04455493…6d846c
-−1.03204128 BTC
-From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
-Block 961,027
-
-To 153La7Fb…Wmav
 
 1a454301…c772c2
 −2.00017714 BTC
 Block 961,025
 
 To bc1q5cyd…jsyq
+
+HOP 1
+1ea85b40…4c37e4
+−0.02282557 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,024
+
+To bc1qvh4u…ahu6
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$123,117,907

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,286,352
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,874,012
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  66. source content difference between and source content +326 -124

    The tracker recorded new outbound spending from the P2TR vault, increasing reported moved holdings from 6.81368697 BTC to 10.82430037 BTC.

    seen · Captured here 24,991 chars
    What changed from the previous capture 450 lines 
     
 BALANCE ON WATCH
 
-1,476.78438105 BTC
+1,472.77376765 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 STILL HELD
 
-99.5%
+99.3%
 
 of 1,483.59806802 BTC consolidated
 
 MOVED
 
-6.81368697 BTC
+10.82430037 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,832
-
-0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
+Block 961,034
+
+0.69994653 BTC from Hop 1 from P2TR vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02064897 BTC
-<live-fiat-value>
-	562.02021083 BTC	30	HELD
+	bc1qq85v2c…3fcu9r	562.02074897 BTC
+<live-fiat-value>
+	562.02021083 BTC	31	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576957 BTC
 
 P2TR vault
 Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897).
-	bc1p0l0xs2…6qlk0h	10.44811501 BTC
-<live-fiat-value>
-	10.44811501 BTC	129	HELD
+	bc1p0l0xs2…6qlk0h	6.43740161 BTC
+<live-fiat-value>
+	10.44811501 BTC	128	PARTIAL
 LIKELY WAVE 4 · AUG 3
 Source
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
-822230d2…e3083a
-−0.47797906 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
-Block 960,832
-
-To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
-
-HOP 1
-15d1287d…e9bdf0
-−0.50633044 BTC
-From Hop 1 from Wave 4 park bc1qa2xv…c3y9
-Block 960,822
-
-To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
-
-23a84f33…bc709c
-−2.81971503 BTC
-From Wave 4 park 1N8knQCf…qfDo
-Block 960,818
-
-To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
+263c9e61…6b330a
+−0.54998482 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qz0zw…2jpd
+Unconfirmed
+
+To 3B7LwHkn…puua, bc1qprnf…59c0
+
+HOP 1
+0c60a619…5b6850
+−0.69994653 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+1fe0f9e5…7042f1
+−0.00104176 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To bc1qjlv0…ehrf
+
+HOP 1
+2413c7d9…39c0c0
+−0.69657013 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+432031dc…e14880
+−0.69882107 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+d6f1c564…b12e0f
+−0.70332292 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+d7309842…498bbb
+−0.70107198 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+d95a5204…208ba2
+−0.43400819 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+e18b1027…8206d1
+−0.70219745 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+e7d7b7b2…e20a1e
+−0.00262925 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To bc1q0v7x…ljtq
+
+HOP 1
+ea2d4340…5d97d5
+−0.6976956 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To 13i9ZaXB…7vQt
+
+HOP 1
+f98cec48…be5391
+−0.00077502 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,034
+
+To bc1qagp2…xnm8
+
+HOP 1
+38cb29ff…0cf27b
+−0.3341999 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,033
+
+To bc1qesrv…d78w
+
+HOP 1
+808af84a…48bfe1
+−0.00040225 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,033
+
+To bc1q9497…6kxj
+
+HOP 1
+c3c35ac9…2cb19d
+−0.54999482 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,033
+
+To bc1qz0zw…2jpd
+
+2c7075a3…5012cc
+−1.00017899 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,032
+
+To bc1qqa7p…36pr
+
+HOP 1
+1cbcccbd…6aba8c
+−0.10338209 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,032
+
+To bc1qw6sr…vmhg
+
+HOP 1
+3325af44…a9f242
+−0.00185692 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1qctxe…yeq0
+
+HOP 1
+4935ab6d…a6a98c
+−0.00091304 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1qj5vu…c7j8
+
+HOP 1
+aa7c9836…8cf1f7
+−0.00188338 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1qmmd0…x8dy
+
+HOP 1
+bd3e0d1a…f4e1b6
+−0.00009278 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1q88zc…aea4
+
+HOP 1
+d37d6901…bac7b6
+−0.00061835 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qkg64…xygt
+
+HOP 1
+d4359621…f65f37
+−0.04268252 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1qcdl5…28p6
+
+HOP 1
+ee4e4c70…2105f2
+−0.00282469 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,030
+
+To bc1qz9hf…97s0
+
+HOP 1
+f554b1a5…0f670f
+−0.0011621 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1q49ew…wafd
+
+HOP 1
+f9981ae7…960657
+−0.03881964 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,030
+
+To bc1qmj87…rdsd
+
+HOP 1
+12c465e5…f31571
+−0.03762413 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,028
+
+To bc1q882w…py6z
+
+HOP 1
+56de84ef…f20b59
+−0.04034895 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,028
+
+To bc1q8wpl…jz2z
+
+HOP 1
+58932a6d…7eb177
+−0.229641 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1q080c…wua8
+
+HOP 1
+756c6a12…996ce5
+−0.03298145 BTC
+From Hop 1 from P2TR vault bc1q2nfx…kyyq
+Block 961,028
+
+To bc1q56hf…2eth
+
+HOP 1
+d58b2c53…3d82a4
+−0.25476269 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,028
+
+To bc1qqm62…efvn
+
+HOP 1
+00987d33…2e738f
+−0.00231734 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qt6f9…8tfz
+
+HOP 1
+204afe34…a3203b
+−0.27432425 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qqm62…efvn
+
+HOP 1
+8458986a…c9d375
+−0.00022475 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1qddn8…ucc7
+
+HOP 1
+ed2daae8…4e77ff
+−0.00309258 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,027
+
+To bc1q2tj0…lj63
 
 HOP 2
-24ed08ad…a7f583
-−4.27762101 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
-Block 960,797
-
-To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
-
-HOP 1
-6c85668e…d30bbb
-−0.02374887 BTC
-From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
-
-6f19b1b9…fdd235
-−2.79332251 BTC
-From Wave 4 park 1N8knQCf…qfDo
-Block 960,793
-
-To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
-
-HOP 2
-f37419c0…eb99d1
-−0.269792 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
-Block 960,669
-
-To bc1qdt6c…srqw
-
-HOP 1
-61c0ddac…98c095
-−0.509799 BTC
-From Hop 1 from Evening vault bc1qu2uq…6srw
-Block 960,668
-
-To bc1qt8ca…5y4k, bc1qzkap…6e4z
-
-HOP 2
-49dd2935…d49564
-−0.24 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
-Block 960,668
-
-To bc1qprkj…jr98
-
-ff327937…abc133
-−0.50980268 BTC
-From Evening vault bc1q7rms…rcgf
-Block 960,666
-
-To bc1qu2uq…6srw
-
-HOP 2
-3cf126ca…10ae88
-−0.44999667 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
-Block 960,666
-
-To P2SH service hub 3KMmeqPe…qtc8
-
-HOP 1
-a7bf30f0…92fdec
-−0.45 BTC
-From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
-Block 960,663
-
-To 3P3K2MQw…Lfgy
-
-HOP 2
-d0bcdc4a…33c0a0
-−0.24134867 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
-Block 960,661
-
-To P2SH service hub 3KMmeqPe…qtc8
-
-5ecc3052…a8bf87
-−0.69135523 BTC
-From Aug 1 hop vault bc1qayw8…2u0s
-Block 960,658
-
-To bc1qsd9t…jah8, bc1qvrpc…cddc
-
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
+04455493…6d846c
+−1.03204128 BTC
+From Hop 2 from Hop 1 from P2TR vault bc1qesrv…d78w
+Block 961,027
+
+To 153La7Fb…Wmav
+
+1a454301…c772c2
+−2.00017714 BTC
+From P2TR vault bc1p0l0x…lk0h
+Block 961,026
+
+To bc1q2nfx…kyyq
+
+HOP 1
+03d7ba76…5a2320
+−0.00304252 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1qvr9d…85ay
+
+HOP 1
+8c8cd809…92b614
+−0.0030229 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1q987r…al70
+
+HOP 1
+af2216ea…106397
+−0.04560948 BTC
+From Hop 1 from P2TR vault bc1qqa7p…36pr
+Block 961,025
+
+To bc1q5cyd…jsyq
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,846,651

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,133,698
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,863,273
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  67. source content difference between and source content +0 -8

    One duplicate-looking hop record was removed from the tracker’s watched-address listing.

    seen · Captured here 22,525 chars
    What changed from the previous capture 8 lines 
     6c85668e…d30bbb
 −0.02374887 BTC
 From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
-Block 960,794
-
-To bc1qhfdz…3wcx
-
-HOP 1
-6c85668e…d30bbb
-−0.06990788 BTC
-From Hop 1 from Wave 4 park bc1qw79v…83ha
 Block 960,794
 
 To bc1qhfdz…3wcx
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,919,755

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,174,839
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,866,167
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  68. source content difference between and source content +11 -3

    The tracker added Galaxy’s Aug. 3 high-confidence and candidate-Wave-4 totals, its estimate of at least 15 attackers, and a Chainabuse victim linkage for the early Aug. 2 consolidation.

    seen · Captured here 22,638 chars
    What changed from the previous capture 14 lines 
     
 Watched holdings
 
-About 1,923.80748125 BTC drained across known waves. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators.
+About 1,923.80748125 BTC drained across known waves. Galaxy’s Waves 1–3 same-operator total is 1,367.05 BTC across 4,585 addresses; their Aug 3 high-confidence headline is 1,596.00 BTC across ~7,300 addresses (Waves 1–3 + owner-confirmed footprints), or up to ~2,055.00 BTC if candidate Wave 4 is included. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults, untracked lettered footprints, and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators — Galaxy now estimates ≥15 attackers.
 
 GALAXY WAVE 1 · JULY 30
 Source
 EARLY AUG 2 CONSOLIDATION
 Source
 
-Distinct fee/structure from Galaxy Waves 1–3. Community Mk2 drain report plus a Mk3 testing-device victim in the same consolidation; sampled inputs long-dormant and funded after the March 2021 vuln window.
+Distinct fee/structure from Galaxy Waves 1–3. Community Mk2 drain report plus a Mk3 testing-device victim in the same consolidation; sampled inputs long-dormant and funded after the March 2021 vuln window. Chainabuse victim lands in the same vault/tx (block 960668). Likely one of Galaxy’s lettered footprints.
 
 SCOPE
 64.90947964 BTC · 902 inputs
 LIKELY WAVE 4 · AUG 3
 Source
 
-Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Press totals near 1,816 BTC are Galaxy’s Waves 1–3 (1,367.05) plus their 448.73 — not our stricter cut. Watched addresses are a sparse still-held sample.
+Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Galaxy’s Aug 3 ceiling ~2,055 BTC is their high-confidence 1,596 plus this 448.73 candidate — not our stricter 443.34 cut. Watched addresses are a sparse still-held sample.
 
 SCOPE
 443.34 BTC · 703 addrs
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
+Galaxy Research · $100M update
+
+Aug 3: high-confidence 1,596 BTC / ~7,300 addresses across Waves 1–3 + 14 owner-confirmed footprints; candidate Wave 4 would bring ~2,055 BTC. Multiple independent attackers. Waves 1–3 coins still unmoved.
+
+Alex Thorn · Footprint O
+
+Aug 4: ≥15 attackers (footprints A–O). Overnight footprint O ~12 BTC from 126 addresses from one victim report; no public address list yet.
+
 Galaxy Research · Wave 3
 
 Aug 1: third wave (~207.73 BTC into 293 P2WSH vaults). Observed total 1,367.05 BTC across 4,585 addresses.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,758,155

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,083,897
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,859,770
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  69. source content difference between and source content +8 -0

    The movement feed gained a new HOP 2 entry: transaction 49dd2935...d49564 moved 0.24 BTC in block 960,668 from the Hop 2 address that descends from the Evening vault via bc1qzkap...6e4z, onward to bc1qprkj...jr98.

    seen · Captured here 21,854 chars
    What changed from the previous capture 8 lines 
     Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
+
+HOP 2
+49dd2935…d49564
+−0.24 BTC
+From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
+Block 960,668
+
+To bc1qprkj…jr98
 
 ff327937…abc133
 −0.50980268 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,321,451

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,838,135
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,842,481
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  70. source content difference between and source content +0 -8

    The tracker removed a Hop 2 movement entry (tx 49dd2935...d49564, 0.24 BTC onward from bc1qzkap...6e4z to bc1qprkj...jr98 in block 960,668) from its evening-vault movement chain. No balances or other entries changed in this capture.

    seen · Captured here 21,734 chars
    What changed from the previous capture 8 lines 
     Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
-
-HOP 2
-49dd2935…d49564
-−0.24 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
-Block 960,668
-
-To bc1qprkj…jr98
 
 ff327937…abc133
 −0.50980268 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,667,736

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,033,012
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,856,190
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  71. source content difference between and source content +11 -9

    The tracker added a 'Known waves only, total most likely higher' caveat under its headline and reworded the watched-holdings note from 'tracked clusters' to 'known waves'. The on-watch balance and moved figure shifted slightly (1,476.78438105 and 6.81368697 BTC), and Holding 1 and Holding 2 live balances and UTXO counts moved while both stayed HELD.

    seen · Captured here 21,854 chars
    What changed from the previous capture 20 lines 
     1,923.80748125 BTC
 
 <live-fiat-value>
+
+Known waves only · total most likely higher
 
 8 waves · Jul 30 – Aug 3 UTC
 
 
 BALANCE ON WATCH
 
-1,476.78435505 BTC
+1,476.78438105 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-6.81371297 BTC
+6.81368697 BTC
 
 Reported consolidation has left the holding addresses
 
 
 Watched holdings
 
-About 1,923.80748125 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators.
+About 1,923.80748125 BTC drained across known waves. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02062897 BTC
-<live-fiat-value>
-	562.02021083 BTC	28	HELD
+	bc1qq85v2c…3fcu9r	562.02064897 BTC
+<live-fiat-value>
+	562.02021083 BTC	30	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.47576357 BTC
-<live-fiat-value>
-	398.47575357 BTC	3	HELD
+	bc1qx76cae…htfhe3	398.47576957 BTC
+<live-fiat-value>
+	398.47575357 BTC	4	HELD
 
 Holding 3
 	bc1q8jy96f…kwtp3q	89.6232889 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,738,917

Known waves only · total most likely higher

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,073,070
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,859,008
JUL 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  72. source content difference between and source content +5 -5

    The tracker annotated Wave 3 vault 6 as a Chainabuse victim's ~5.39 BTC Mk3 drain parked into that vault, and rewrote the Wave 4 Chainabuse victim label into a single inline attribution. The live UTXO counts for the Wave 4 vaults also moved off zero (62, 1 and 129 UTXOs respectively) while balances stayed HELD.

    seen · Captured here 21,814 chars
    What changed from the previous capture 10 lines 
     	6.88509195 BTC	1	HELD
 
 Wave 3 vault 6
+Chainabuse victim · ~5.39 BTC Mk3 drain (park → this vault).
 	bc1qysjc4j…pkkx7h	5.39098601 BTC
 <live-fiat-value>
 	5.39098601 BTC	1	HELD
 later also ~25–40
 PATTERN
 1-vout → P2TR
-Chainabuse victim
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 P2TR vault
-Chainabuse victim destination; 62× ~5 sat/vB sweeps (blocks 960737–960750).
+Chainabuse victim · 62× ~5 sat/vB sweeps (blocks 960737–960750).
 	bc1pum5zf6…8ftmy8	0.50992489 BTC
 <live-fiat-value>
-	0.50992489 BTC	0	HELD
+	0.50992489 BTC	62	HELD
 
 P2TR hop vault
 Consolidate from emptied collector bc1ptd5x… (101 inputs @ block 960736).
 	bc1pdl33jt…luu9ce	36.01585057 BTC
 <live-fiat-value>
-	36.01585057 BTC	0	HELD
+	36.01585057 BTC	1	HELD
 
 P2TR vault
 Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897).
 	bc1p0l0xs2…6qlk0h	10.44811501 BTC
 <live-fiat-value>
-	10.44811501 BTC	0	HELD
+	10.44811501 BTC	129	HELD
 LIKELY WAVE 4 · AUG 3
 Source
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$122,080,975

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,702,804
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,832,961
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  73. source content difference between and source content +51 -8

    The tracker added a new P2TR wave (Aug 1-3, 46.97389047 BTC watched across 3 Kelbie-reported Taproot sinks, ~5 sat/vB 1-vout sweeps, one corroborated by a Chainabuse victim report), credited Kevin Kelbie for it, and raised the totals: stolen from 1,876.83359078 to 1,923.80748125 BTC across 8 waves, balance on watch from 1,429.81046458 to 1,476.78435505 BTC.

    seen · Captured here 21,779 chars
    What changed from the previous capture 59 lines 
     Blocked
 TOTAL STOLEN
 
-1,876.83359078 BTC
-
-<live-fiat-value>
-
-7 waves · Jul 30 – Aug 3 UTC
+1,923.80748125 BTC
+
+<live-fiat-value>
+
+8 waves · Jul 30 – Aug 3 UTC
 
 0
 300
 Early Aug 2 consolidation
 +64.90947964 BTC
 <live-fiat-value>
+AUG 1
+P2TR wave · Aug 1–3
++46.97389047 BTC
+<live-fiat-value>
 AUG 3
 Likely Wave 4 · Aug 3
 +443.34 BTC
 
 BALANCE ON WATCH
 
-1,429.81046458 BTC
+1,476.78435505 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 99.5%
 
-of 1,436.62417755 BTC consolidated
+of 1,483.59806802 BTC consolidated
 
 MOVED
 
 
 Watched holdings
 
-About 1,876.83359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, Wave 4) may be different operators.
+About 1,923.80748125 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,483.59806802 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, P2TR, Wave 4) may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 	bc1q0rvn88…jf5q6m	64.90373764 BTC
 <live-fiat-value>
 	64.90373764 BTC	1	HELD
+P2TR WAVE · AUG 1–3
+Source
+
+Distinct from Wave 4: ~5 sat/vB (later also 25/40) 1-vout multi-path sweeps into Taproot consolidations. Small vault corroborated by a Chainabuse Coldcard-hack victim report; larger sibling/hop verified on-chain with the same fingerprint. Watched set is Kelbie’s published sample, not every P2TR sink.
+
+SCOPE
+46.97389047 BTC watched
+3 Kelbie P2TR sinks
+BLOCKS
+960,624–960,897
+FEE
+~5 sat/vB
+later also ~25–40
+PATTERN
+1-vout → P2TR
+Chainabuse victim
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+P2TR vault
+Chainabuse victim destination; 62× ~5 sat/vB sweeps (blocks 960737–960750).
+	bc1pum5zf6…8ftmy8	0.50992489 BTC
+<live-fiat-value>
+	0.50992489 BTC	0	HELD
+
+P2TR hop vault
+Consolidate from emptied collector bc1ptd5x… (101 inputs @ block 960736).
+	bc1pdl33jt…luu9ce	36.01585057 BTC
+<live-fiat-value>
+	36.01585057 BTC	0	HELD
+
+P2TR vault
+Later sibling; fees mostly ~5 sat/vB with 25/40 bands (blocks 960773–960897).
+	bc1p0l0xs2…6qlk0h	10.44811501 BTC
+<live-fiat-value>
+	10.44811501 BTC	0	HELD
 LIKELY WAVE 4 · AUG 3
 Source
 
 
 Independently flagged the ~45.9 BTC July 31 vault (now Galaxy Wave 2) after Block’s scan window; RBF differed from Wave 1.
 
+Kevin Kelbie · P2TR wave
+
+Aug 3: ~0.51 BTC Chainabuse-corroborated P2TR sink plus two larger sibling Taproot consolidations (~36 + ~10 BTC) at ~5 sat/vB — distinct from Wave 4.
+
 Evan Schoenberg
 
 Evening July 31 low-fee (~2 sat/vB) sweeps into a separate vault; Aug 1 hop consolidation (incl. delayed ~0.19 BTC) raised the watched cluster to ~1.20 BTC.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,923.80748125 BTC

$121,838,575

8 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,566,390
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,823,365
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  74. source content difference between and source content +11 -3

    The tracker recorded a new hop-2 movement: 0.47797906 BTC spent at block 960,832 from a Hop 2 address downstream of the Wave 4 park, sent to 15 outputs. The movement feed gained the corresponding entry.

    seen · Captured here 20,552 chars
    What changed from the previous capture 14 lines 
     
 LAST MOVEMENT
 
-Block 960,822
-
-0.50633044 BTC from Hop 1 from Wave 4 park
+Block 960,832
+
+0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 2
+822230d2…e3083a
+−0.47797906 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
+Block 960,832
+
+To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
 
 HOP 1
 15d1287d…e9bdf0
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$119,507,379

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,937,739
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,849,488
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  75. source content difference between and source content +8 -16

    The tracker withdrew the Hop 2 spend of 0.47797906 BTC at block 960,832 from its movement feed; the last movement is now the earlier Hop 1 spend of 0.50633044 BTC at block 960,822. Watched balances drifted upward again and Holding 1's UTXO count rose from 24 to 28.

    seen · Captured here 20,378 chars
    What changed from the previous capture 24 lines 
     
 BALANCE ON WATCH
 
-1,429.81028381 BTC
+1,429.81046458 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-6.81389374 BTC
+6.81371297 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,832
-
-0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
+Block 960,822
+
+0.50633044 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.0204482 BTC
-<live-fiat-value>
-	562.02021083 BTC	24	HELD
+	bc1qq85v2c…3fcu9r	562.02062897 BTC
+<live-fiat-value>
+	562.02021083 BTC	28	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
-
-HOP 2
-822230d2…e3083a
-−0.47797906 BTC
-From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
-Block 960,832
-
-To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
 
 HOP 1
 15d1287d…e9bdf0
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$119,817,056

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,116,376
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,862,054
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  76. source content difference between and source content +5 -5

    The watched balance rose from 1,429.81024343 to 1,429.81028381 BTC, the moved total dipped by the same roughly 0.00004 BTC, and Holding 1's displayed UTXO count rose from 21 to 24 while its status stayed HELD.

    seen · Captured here 20,551 chars
    What changed from the previous capture 10 lines 
     
 BALANCE ON WATCH
 
-1,429.81024343 BTC
+1,429.81028381 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-6.81393412 BTC
+6.81389374 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02040782 BTC
-<live-fiat-value>
-	562.02021083 BTC	21	HELD
+	bc1qq85v2c…3fcu9r	562.0204482 BTC
+<live-fiat-value>
+	562.02021083 BTC	24	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$119,766,382

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,087,144
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,859,998
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  77. source content difference between and source content +32 -225

    The tracker's watched balance and moved totals shifted slightly and Holding 1 gained a UTXO, the last-movement card pointed at an earlier block, and the movement feed added a methodology line ("Stops at known exchange, bridge, and service-hub exits") while dropping many older hop-2 entries and adding a few new ones.

    seen · Captured here 20,552 chars
    What changed from the previous capture 257 lines 
     
 BALANCE ON WATCH
 
-1,429.81019684 BTC
+1,429.81024343 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-6.81398071 BTC
+6.81393412 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,882
-
-2.6914075 BTC from Hop 2 from Hop 1 from Wave 4 park
+Block 960,832
+
+0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02036123 BTC
-<live-fiat-value>
-	562.02021083 BTC	20	HELD
+	bc1qq85v2c…3fcu9r	562.02040782 BTC
+<live-fiat-value>
+	562.02021083 BTC	21	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 	0.96227191 BTC	1	HELD
 Movement feed
 
-Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
-
-HOP 2
-b74ef532…1fd15c
-−45.9000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Unconfirmed
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-e00eaf8c…bfb5a6
-−2.6914075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,882
-
-To 38MfJkxP…DpWr
-
-HOP 2
-6f74d82c…b6d36e
-−40.0000805 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,880
-
-To 168Bveij…96P4
-
-HOP 2
-761208db…ab73ba
-−10.8125075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,880
-
-To 35uR5adi…FVw5
-
-HOP 2
-7febd39c…be450b
-−1.3540075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,880
-
-To 3JZ3byZy…CrNw
-
-HOP 2
-a5935658…84be3b
-−25.0000965 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,880
-
-To 15cCD235…Ad46
-
-HOP 1
-a6f736a6…d4c762
-−24.1374 BTC
-From Hop 1 from Wave 4 park 3CTpBmp8…2hBH
-Block 960,877
-
-To 324H9uyT…5CYq, 3CdVzfAe…xAUs
-
-HOP 2
-0259239d…a86ef9
-−1.5152085 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,877
-
-To 1GPRueEB…FUWL
-
-HOP 2
-420754a6…348fd0
-−48.1000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,877
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-50aed31e…85a568
-−3.7783075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,877
-
-To 38MfJkxP…DpWr
-
-HOP 2
-a1dd6e93…f2b9f6
-−5.7903075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,877
-
-To 35uR5adi…FVw5
-
-HOP 2
-a6f736a6…d4c762
-−60.35670532 BTC
-From Hop 2 from Hop 1 from Wave 4 park 3CdVzfAe…xAUs
-Block 960,877
-
-To 324H9uyT…5CYq
-
-HOP 2
-6a3cd6aa…177d24
-−52.5000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,875
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-2d6ef6b8…bc4154
-−1.3676075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,874
-
-To 38MfJkxP…DpWr
-
-HOP 2
-497a68a0…c40c24
-−46.0000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,874
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-c49139bc…e16d9d
-−7.0000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,874
-
-To 1JJWhbEi…MY7S
-
-HOP 2
-58740e23…22d13f
-−45.0000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,869
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-a005d3a8…140b6d
-−21.4003285 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,857
-
-To 168Bveij…96P4
-
-HOP 2
-53316619…dc1b58
-−114.99271916 BTC
-From Hop 2 from Hop 1 from Wave 4 park 3CdVzfAe…xAUs
-Block 960,844
-
-To 324H9uyT…5CYq
-
-HOP 2
-dfab7bd4…1aa9b4
-−45.1000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,844
-
-To 1KbDEg1t…aFx5
-
-HOP 2
-7476bd48…ca0c39
-−50.9700475 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,843
-
-To 33sB7g4z…ozuB
-
-HOP 2
-7e0f4c39…cdf67d
-−30.1000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,837
-
-To 1KbDEg1t…aFx5
+Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Stops at known exchange, bridge, and service-hub exits — later custodian churn is not listed. Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
 822230d2…e3083a
 
 To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
 
-HOP 2
-6d2ded5e…3c2937
-−14.0000485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,829
-
-To 1JaLcWma…pf5Q
-
-HOP 2
-3622d884…410bd0
-−5.7967075 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,825
-
-To 3JZ3byZy…CrNw
-
 HOP 1
 15d1287d…e9bdf0
 −0.50633044 BTC
 To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
 
 HOP 2
-59635c29…f69257
-−2.9990485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,810
-
-To 182DE3tw…Zs5E
-
-HOP 2
-8a0f5d0f…477c6e
-−0.0001375 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,810
-
-To 3AMfsBd3…XBKS
-
-HOP 2
-99db6af0…4cc4fa
-−0.0010485 BTC
-From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
-Block 960,810
-
-To 182DE3tw…Zs5E
-
-HOP 2
 24ed08ad…a7f583
 −4.27762101 BTC
 From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
 Block 960,797
 
 To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
+HOP 1
+6c85668e…d30bbb
+−0.02374887 BTC
+From Hop 1 from Wave 4 park 3EkYzYXT…DWeF
+Block 960,794
+
+To bc1qhfdz…3wcx
 
 HOP 1
 6c85668e…d30bbb
 Block 960,661
 
 To P2SH service hub 3KMmeqPe…qtc8
+
+5ecc3052…a8bf87
+−0.69135523 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Block 960,658
+
+To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+Block 960,658
+
+To 36c8aprK…QW35
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$119,773,889

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$69,091,475
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,860,303
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  78. source content difference between and source content +247 -24

    The tracker added a large batch of new outbound hop transactions from the Wave 4 park address 324H9uyT...5CYq (blocks 960,810 to 960,882, several over 45 BTC each, one still unconfirmed), reinstated the 0.45 and 0.44999667 BTC Aug 1 vault hops while dropping two other vault hops, and nudged the watched balance to 1,429.81019684 BTC with Holding 1 at 20 UTXOs. It also added a Multisig urgency and Slipstream guidance section and a Nunchuk entry to its reading list.

    seen · Captured here 23,453 chars
    What changed from the previous capture 271 lines 
     
 BALANCE ON WATCH
 
-1,429.81009788 BTC
+1,429.81019684 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-6.81407967 BTC
+6.81398071 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,832
-
-0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
+Block 960,882
+
+2.6914075 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02026227 BTC
-<live-fiat-value>
-	562.02021083 BTC	18	HELD
+	bc1qq85v2c…3fcu9r	562.02036123 BTC
+<live-fiat-value>
+	562.02021083 BTC	20	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 
 HOP 2
+b74ef532…1fd15c
+−45.9000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Unconfirmed
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+e00eaf8c…bfb5a6
+−2.6914075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,882
+
+To 38MfJkxP…DpWr
+
+HOP 2
+6f74d82c…b6d36e
+−40.0000805 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,880
+
+To 168Bveij…96P4
+
+HOP 2
+761208db…ab73ba
+−10.8125075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,880
+
+To 35uR5adi…FVw5
+
+HOP 2
+7febd39c…be450b
+−1.3540075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,880
+
+To 3JZ3byZy…CrNw
+
+HOP 2
+a5935658…84be3b
+−25.0000965 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,880
+
+To 15cCD235…Ad46
+
+HOP 1
+a6f736a6…d4c762
+−24.1374 BTC
+From Hop 1 from Wave 4 park 3CTpBmp8…2hBH
+Block 960,877
+
+To 324H9uyT…5CYq, 3CdVzfAe…xAUs
+
+HOP 2
+0259239d…a86ef9
+−1.5152085 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,877
+
+To 1GPRueEB…FUWL
+
+HOP 2
+420754a6…348fd0
+−48.1000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,877
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+50aed31e…85a568
+−3.7783075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,877
+
+To 38MfJkxP…DpWr
+
+HOP 2
+a1dd6e93…f2b9f6
+−5.7903075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,877
+
+To 35uR5adi…FVw5
+
+HOP 2
+a6f736a6…d4c762
+−60.35670532 BTC
+From Hop 2 from Hop 1 from Wave 4 park 3CdVzfAe…xAUs
+Block 960,877
+
+To 324H9uyT…5CYq
+
+HOP 2
+6a3cd6aa…177d24
+−52.5000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,875
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+2d6ef6b8…bc4154
+−1.3676075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,874
+
+To 38MfJkxP…DpWr
+
+HOP 2
+497a68a0…c40c24
+−46.0000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,874
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+c49139bc…e16d9d
+−7.0000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,874
+
+To 1JJWhbEi…MY7S
+
+HOP 2
+58740e23…22d13f
+−45.0000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,869
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+a005d3a8…140b6d
+−21.4003285 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,857
+
+To 168Bveij…96P4
+
+HOP 2
+53316619…dc1b58
+−114.99271916 BTC
+From Hop 2 from Hop 1 from Wave 4 park 3CdVzfAe…xAUs
+Block 960,844
+
+To 324H9uyT…5CYq
+
+HOP 2
+dfab7bd4…1aa9b4
+−45.1000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,844
+
+To 1KbDEg1t…aFx5
+
+HOP 2
+7476bd48…ca0c39
+−50.9700475 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,843
+
+To 33sB7g4z…ozuB
+
+HOP 2
+7e0f4c39…cdf67d
+−30.1000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,837
+
+To 1KbDEg1t…aFx5
+
+HOP 2
 822230d2…e3083a
 −0.47797906 BTC
 From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
 Block 960,832
 
 To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
+
+HOP 2
+6d2ded5e…3c2937
+−14.0000485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,829
+
+To 1JaLcWma…pf5Q
+
+HOP 2
+3622d884…410bd0
+−5.7967075 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,825
+
+To 3JZ3byZy…CrNw
 
 HOP 1
 15d1287d…e9bdf0
 To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
 
 HOP 2
+59635c29…f69257
+−2.9990485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,810
+
+To 182DE3tw…Zs5E
+
+HOP 2
+8a0f5d0f…477c6e
+−0.0001375 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,810
+
+To 3AMfsBd3…XBKS
+
+HOP 2
+99db6af0…4cc4fa
+−0.0010485 BTC
+From Hop 2 from Hop 1 from Wave 4 park 324H9uyT…5CYq
+Block 960,810
+
+To 182DE3tw…Zs5E
+
+HOP 2
 24ed08ad…a7f583
 −4.27762101 BTC
 From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
 To bc1qu2uq…6srw
 
 HOP 2
+3cf126ca…10ae88
+−0.44999667 BTC
+From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
+Block 960,666
+
+To P2SH service hub 3KMmeqPe…qtc8
+
+HOP 1
+a7bf30f0…92fdec
+−0.45 BTC
+From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
+Block 960,663
+
+To 3P3K2MQw…Lfgy
+
+HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
 From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
 
 To P2SH service hub 3KMmeqPe…qtc8
 
-5ecc3052…a8bf87
-−0.69135523 BTC
-From Aug 1 hop vault bc1qayw8…2u0s
-Block 960,658
-
-To bc1qsd9t…jah8, bc1qvrpc…cddc
-
-HOP 1
-135d4c2c…2d4ce9
-−0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Block 960,658
-
-To 36c8aprK…QW35
-
 Am I at risk?
 
-Short checklist from Coinkite’s Aug 1 advisory, Block’s root-cause writeup, and WizardSardine’s analysis. This tracker does not check your wallet — follow the official steps before moving funds.
+Short checklist from Coinkite’s Aug 1 advisory, Block’s root-cause writeup, WizardSardine’s analysis, and Nunchuk’s multisig migration guidance. This tracker does not check your wallet — follow the official steps before moving funds.
 
 LIKELY EXPOSED
 
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
 MIGRATE BEFORE YOU UPGRADE
 If this Coldcard is your only signer for a weak seed, move funds first. Community reports (including Jameson Lopp) flag a non-zero chance the hotfix upgrade bricks the unit; an open firmware PR argues a sticky TRNG fault after the hotfix can lock the keypad before login. Prefer sweeping to a new seed on a second fixed device when possible.
+MULTISIG URGENCY & SLIPSTREAM
+If Coldcard-generated keys alone could meet your signing threshold (e.g. 2-of-3 with two Coldcard keys), migrate now — those wallets can be swept. One Coldcard key below threshold is lower urgency but still migrate. Broadcasting a migration to the public mempool opens a brief RBF-sniping window while weak keys remain spendable; Nunchuk recommends submitting the signed hex via MARA Slipstream instead (now public, no code). That keeps the tx out of the public mempool but trusts MARA and can confirm slower (~5–6% hashrate). No multisig sweeps reported yet.
 ORIGIN OF THE SEED
 Exposure follows where the seed was generated, not the device holding it today. Seeds imported elsewhere, or whose origin you cannot establish, should be treated as affected.
 BEYOND THE MAIN SEED
 
 Aug 1 deep dive: who is affected (including Mk3 5.0.x), advanced features still broken with dice seeds, and migration guidance.
 
+Nunchuk · Slipstream migration
+
+Aug 3: multisig urgency tiers (Coldcard keys alone vs below threshold) and MARA Slipstream to avoid RBF-sniping during migration; Slipstream now public with no code.
+
 Kevin Loaec
 
 Announcement thread for the WizardSardine writeup.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$119,529,901

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,950,731
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,850,402
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  79. source content difference between and source content +1 -17

    The tracker removed two hop transactions (a 0.45 BTC hop and a 0.44999667 BTC hop through 3P3K2MQw...Lfgy) from its chain trace, and expanded its migration guidance: it now cites an open firmware PR arguing that a sticky TRNG fault after the hotfix can lock the keypad before login, alongside the existing bricking warning.

    seen · Captured here 19,261 chars
    What changed from the previous capture 18 lines 
     To bc1qu2uq…6srw
 
 HOP 2
-3cf126ca…10ae88
-−0.44999667 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
-Block 960,666
-
-To P2SH service hub 3KMmeqPe…qtc8
-
-HOP 1
-a7bf30f0…92fdec
-−0.45 BTC
-From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
-Block 960,663
-
-To 3P3K2MQw…Lfgy
-
-HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
 From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
 MIGRATE BEFORE YOU UPGRADE
-If this Coldcard is your only signer for a weak seed, move funds first. Community reports (including Jameson Lopp) flag a non-zero chance the hotfix upgrade bricks the unit. Prefer sweeping to a new seed on a second fixed device when possible.
+If this Coldcard is your only signer for a weak seed, move funds first. Community reports (including Jameson Lopp) flag a non-zero chance the hotfix upgrade bricks the unit; an open firmware PR argues a sticky TRNG fault after the hotfix can lock the keypad before login. Prefer sweeping to a new seed on a second fixed device when possible.
 ORIGIN OF THE SEED
 Exposure follows where the seed was generated, not the device holding it today. Seeds imported elsewhere, or whose origin you cannot establish, should be treated as affected.
 BEYOND THE MAIN SEED
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$118,692,833

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,467,869
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,816,435
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  80. source content difference between and source content +8 -8

    The Watched holdings paragraph was revised: the remaining roughly 440.2 BTC is now described as mostly unwatched Wave 4 destinations (a sparse still-held sample) plus smaller or unmatched Wave 3 vaults and fees, and the different-operators caveat now lists the community waves by name. The Balance on Watch stat block also moved above the Still Held block, which is presentational.

    seen · Captured here 19,418 chars
    What changed from the previous capture 16 lines 
     +443.34 BTC
 <live-fiat-value>
 
+BALANCE ON WATCH
+
+1,429.81009788 BTC
+
+<live-fiat-value>
+<live-fiat-value>
+
 STILL HELD
 
 99.5%
 
 of 1,436.62417755 BTC consolidated
 
-BALANCE ON WATCH
-
-1,429.81009788 BTC
-
-<live-fiat-value>
-<live-fiat-value>
-
 MOVED
 
 6.81407967 BTC
 
 Watched holdings
 
-About 1,876.83359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~440.20941323 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,876.83359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings. The remaining ~440.20941323 BTC is mostly unwatched Wave 4 destinations (sparse still-held sample), plus smaller/unmatched Wave 3 vaults and fees. Community waves (evening, morning, early Aug 2, Wave 4) may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$117,553,595

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$67,810,700
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,770,205
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  81. source content difference between and source content +6 -6

    The cash-out section expanded from two rails to three, adding a roughly 0.27 BTC rail from the evening vault through bc1qdt6c and bc1qs86u into two KuCoin deposits (emptied Aug 3 01:22 UTC). The Wave 4 note now also explains the tracker's 443.34 BTC figure as Galaxy's revised 448.73 BTC minus six destinations with prior on-chain history, and reconciles it against press totals near 1,816 BTC.

    seen · Captured here 19,413 chars
    What changed from the previous capture 12 lines 
     FEE
 ~1–2 sat/vB
 
-AUG 2 CASH-OUT · TWO RAILS
+AUG 2–3 CASH-OUT · THREE RAILS
 
 BTC · ~0.69
 Aug 1 hop vault→3KMmeqPe… hub · likely custodial/swap deposit — hops already mixed out; stolen BTC effectively gone from watchable stack
 ETH · ~11.7
 Evening vault→THOR→0x6A08…→0xC61F…→vanity hops→KuCoin 17 · emptied Aug 2 20:29 UTC (~11.70 ETH); consolidated with ~11.08 ETH from a parallel stack into a 23 ETH deposit; also funded via Orbiter Bridge 3 peels
-Sibling ~0.27 BTC still at bc1qdt6c…
+BTC · ~0.27
+Evening vault→bc1qdt6c…→bc1qs86u… consol.→KuCoin 328Gx… · KuCoin 3JEQ… · emptied Aug 3 01:22 UTC; ~0.27 mixed into a 1.54 BTC multi-input stack (block 960800), then peeled to two KuCoin deposits (~0.70 + ~0.84)
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Jul 31 consolidation (~0.51 BTC). Emptied Aug 2 via THOR→ETH; ETH park 0xC61F emptied Aug 2 20:29 UTC into vanity hops → KuCoin 17
+Jul 31 consolidation (~0.51 BTC). Emptied Aug 2–3 (ETH + BTC rails above).
 	bc1q7rmsw0…lrrcgf	0.00 BTC
 <live-fiat-value>
 	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
-0.4998 + 0.1915 BTC stack. Emptied Aug 2 into likely custodial/swap P2SH hub — hops mixed out; see BTC rail above. Ocean peel also met there (not in report balance)
+0.4998 + 0.1915 BTC stack. Emptied Aug 2 (BTC rail above). Ocean peel also met at the hub (not in report balance).
 	bc1qayw8nr…7w2u0s	0.00 BTC
 <live-fiat-value>
 	0.69135523 BTC	0	EMPTIED
 LIKELY WAVE 4 · AUG 3
 Source
 
-Pattern-match only (no victim report yet). Watched addresses are a sparse still-held sample.
+Pattern-match only (no victim report yet). Galaxy’s revised Wave 4 figure is 448.73 BTC after cutting 89 multisig destinations. We go one step further and also drop 6 destinations that already had prior on-chain history (−5.39 BTC), so our total is 443.34. Press totals near 1,816 BTC are Galaxy’s Waves 1–3 (1,367.05) plus their 448.73 — not our stricter cut. Watched addresses are a sparse still-held sample.
 
 SCOPE
 443.34 BTC · 703 addrs
-after −89 multisig / −6 prior-history · 210 fresh dests
 BLOCKS
 960,778–960,792
 FEE
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$117,553,595

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$67,810,700
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,770,205
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  82. source content difference between and source content +11 -3

    The movement feed added a Hop 2 spend of 0.47797906 BTC at block 960,832 from the Hop 1 destination of the Wave 4 park vault, paid out across 15 addresses, and the Last Movement panel updated to match. No balance or status lines changed in this capture.

    seen · Captured here 19,067 chars
    What changed from the previous capture 14 lines 
     
 LAST MOVEMENT
 
-Block 960,822
-
-0.50633044 BTC from Hop 1 from Wave 4 park
+Block 960,832
+
+0.47797906 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 2
+822230d2…e3083a
+−0.47797906 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qq0j5…vfz9
+Block 960,832
+
+To bc1qx7pu…xevf, bc1qspw0…vy3w, bc1q728v…gedk +12 more
 
 HOP 1
 15d1287d…e9bdf0
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$117,024,328

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$67,505,393
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,748,728
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  83. source content difference between and source content +39 -22

    The tracker restated Wave 4 as a pattern-match-only estimate (no victim report yet) of about 443.34 BTC across 703 addresses after filtering out 89 multisigs and 6 prior-history destinations, raising the headline total from 1,822.42 to 1,876.83 BTC. The Wave 4 park vault 1N8knQCf emptied (about 2.82 BTC onward to Coinbase Prime Custody at block 960,818), lifting MOVED to 6.81 BTC and adding new hop-1 movement entries.

    seen · Captured here 18,893 chars
    What changed from the previous capture 61 lines 
     Blocked
 TOTAL STOLEN
 
-1,822.42107906 BTC
+1,876.83359078 BTC
 
 <live-fiat-value>
 
 <live-fiat-value>
 AUG 3
 Likely Wave 4 · Aug 3
-+388.92748828 BTC
++443.34 BTC
 <live-fiat-value>
 
 STILL HELD
 
-99.7%
+99.5%
 
 of 1,436.62417755 BTC consolidated
 
 BALANCE ON WATCH
 
-1,432.62980451 BTC
+1,429.81009788 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-3.99437304 BTC
+6.81407967 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,797
-
-4.27762101 BTC from Hop 2 from Hop 1 from Wave 4 park
+Block 960,822
+
+0.50633044 BTC from Hop 1 from Wave 4 park
 
 Watched holdings
 
-About 1,822.42107906 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~385.79690151 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,876.83359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~440.20941323 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02025387 BTC
-<live-fiat-value>
-	562.02021083 BTC	16	HELD
+	bc1qq85v2c…3fcu9r	562.02026227 BTC
+<live-fiat-value>
+	562.02021083 BTC	18	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 LIKELY WAVE 4 · AUG 3
 Source
 
-Watched addresses are a sparse still-held sample.
+Pattern-match only (no victim report yet). Watched addresses are a sparse still-held sample.
 
 SCOPE
-388.92748828 BTC · 218 txs
-462 victims → 216 dests
+443.34 BTC · 703 addrs
+after −89 multisig / −6 prior-history · 210 fresh dests
 BLOCKS
 960,778–960,792
 FEE
 RBF opt-in
 PATTERN
 1:1 victim → fresh dest
-no collector funnel
+likely only — no victim report yet
 FULL LISTS
 Confirmed addresses
-Mempool / RBF list at report
+Mempool / RBF list — unfiltered originals
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 4 park
 	5.07348539 BTC	1	HELD
 
 Wave 4 park
-Thorn’s unique dual-sweep destination (2 victims → this park). One UTXO (~2.79 BTC) peeled block 960793 into Bullish.com · 3CTpBmp…; ~2.82 BTC still held.
-	1N8knQCfjq…WVqfDo	2.81971503 BTC
-<live-fiat-value>
-	5.61303754 BTC	1	PARTIAL
+Thorn’s unique dual-sweep destination (2 victims → this park).
+~2.79→Bullish.com · 960793
+~2.82→Coinbase Prime · 960818 · same cluster as bc1qactq…
+	1N8knQCfjq…WVqfDo	0.00 BTC
+<live-fiat-value>
+	5.61303754 BTC	0	EMPTIED
 
 Wave 4 park
 	342L6n3b61…TSjZtz	2.02374869 BTC
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 1
+15d1287d…e9bdf0
+−0.50633044 BTC
+From Hop 1 from Wave 4 park bc1qa2xv…c3y9
+Block 960,822
+
+To bc1qq0j5…vfz9, bc1qhcpk…c3tl, 38maz2s8…erUH +13 more
+
+23a84f33…bc709c
+−2.81971503 BTC
+From Wave 4 park 1N8knQCf…qfDo
+Block 960,818
+
+To Coinbase Prime Custody bc1qdj58…60ms, bc1qa2xv…c3y9
 
 HOP 2
 24ed08ad…a7f583
 
 Alex Thorn · Likely Wave 4
 
-Aug 3: likely 4th organized wave — ~388.93 BTC confirmed (blocks 960778–960792), 462 victims → 216 fresh 1:1 destinations; full address lists on Pastebin (confirmed + mempool/RBF).
+Aug 3: likely 4th wave by pattern match (no victim report yet). Filtered core ~443.34 BTC / 703 addrs after removing 89 multisigs (−20.58 BTC, per Nunchuk) and 6 prior-history destinations (−5.39 BTC). Original pastebins still list the unfiltered set.
 
 Marius Offchain
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,876.83359078 BTC

$117,852,012

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$67,982,841
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,782,315
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  84. source content difference between and source content +1 -9

    Removed the '1:1 destination sample (still held at add)' annotation row from eight Wave 4 park address entries, and dropped the footer provenance line (core vaults live via snapshot, Wave 3 from cron snapshot, incident facts from Galaxy Research and community cluster reports), leaving only the not-affiliated disclaimer. Balances and statuses were unchanged.

    seen · Captured here 18,473 chars
    What changed from the previous capture 10 lines 
     LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	bc1q05g20l…nju0ml	8.55600708 BTC
 <live-fiat-value>
 	8.55600708 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	bc1qjenjhm…mv4z23	5.07348539 BTC
 <live-fiat-value>
 	5.07348539 BTC	1	HELD
 	5.61303754 BTC	1	PARTIAL
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	342L6n3b61…TSjZtz	2.02374869 BTC
 <live-fiat-value>
 	2.02374869 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	bc1q65e6cd…yce9u8	1.14852067 BTC
 <live-fiat-value>
 	1.14852067 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	36XfMDAYuC…1F1x3G	1.09429601 BTC
 <live-fiat-value>
 	1.09429601 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	bc1qcmnjt0…rfjvtl	1.04998888 BTC
 <live-fiat-value>
 	1.04998888 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	bc1pj7f355…4sulc2	1.03514173 BTC
 <live-fiat-value>
 	1.03514173 BTC	1	HELD
 
 Wave 4 park
-1:1 destination sample (still held at add)
 	34nHYNnc9D…jP4qDQ	0.96227191 BTC
 <live-fiat-value>
 	0.96227191 BTC	1	HELD
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via snapshot; Wave 3 from cron snapshot (<snapshot-time>). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,822.42107906 BTC

$114,830,752

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,217,777
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,798,842
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  85. source content difference between and source content +38 -15

    Recorded the first Wave 4 park movement: about 2.79 BTC peeled to a Bullish.com deposit plus a 4.28 BTC second-hop distribution, lifting MOVED from 1.20 to 3.99 BTC and dropping STILL HELD to 99.7 percent.

    seen · Captured here 18,961 chars
    What changed from the previous capture 53 lines 
     
 STILL HELD
 
-99.92%
+99.7%
 
 of 1,436.62417755 BTC consolidated
 
 BALANCE ON WATCH
 
-1,435.42312702 BTC
+1,432.62980451 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20105053 BTC
+3.99437304 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Block 960,669
-
-0.269792 BTC from Hop 2 from Hop 1 from Evening vault
+Block 960,797
+
+4.27762101 BTC from Hop 2 from Hop 1 from Wave 4 park
 
 Watched holdings
 
 LIKELY WAVE 4 · AUG 3
 Source
 
-Alex Thorn (Galaxy research head): likely Coldcard wave — elevated sweep rate, zero pre-firmware-boundary inputs, 1:1 fresh destinations (no collector). Low fee (~1–3 sat/vB) + RBF opt-in. Watched parks are a sparse still-held sample; full victim/destination lists linked below.
+Watched addresses are a sparse still-held sample.
 
 SCOPE
 388.92748828 BTC · 218 txs
 	5.07348539 BTC	1	HELD
 
 Wave 4 park
-Received two sweeps; partial 2nd-hop already underway at add
-	1N8knQCfjq…WVqfDo	5.61303754 BTC
-<live-fiat-value>
-	5.61303754 BTC	0	HELD
+Thorn’s unique dual-sweep destination (2 victims → this park). One UTXO (~2.79 BTC) peeled block 960793 into Bullish.com · 3CTpBmp…; ~2.82 BTC still held.
+	1N8knQCfjq…WVqfDo	2.81971503 BTC
+<live-fiat-value>
+	5.61303754 BTC	1	PARTIAL
 
 Wave 4 park
 1:1 destination sample (still held at add)
 	342L6n3b61…TSjZtz	2.02374869 BTC
 <live-fiat-value>
-	2.02374869 BTC	0	HELD
+	2.02374869 BTC	1	HELD
 
 Wave 4 park
 1:1 destination sample (still held at add)
 1:1 destination sample (still held at add)
 	36XfMDAYuC…1F1x3G	1.09429601 BTC
 <live-fiat-value>
-	1.09429601 BTC	0	HELD
+	1.09429601 BTC	1	HELD
 
 Wave 4 park
 1:1 destination sample (still held at add)
 1:1 destination sample (still held at add)
 	34nHYNnc9D…jP4qDQ	0.96227191 BTC
 <live-fiat-value>
-	0.96227191 BTC	0	HELD
+	0.96227191 BTC	1	HELD
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 2
+24ed08ad…a7f583
+−4.27762101 BTC
+From Hop 2 from Hop 1 from Wave 4 park bc1qhfdz…3wcx
+Block 960,797
+
+To P2WPKH service hub bc1qactq…80gh, bc1qm26v…3q52, bc1qemas…ahmt +27 more
+
+HOP 1
+6c85668e…d30bbb
+−0.06990788 BTC
+From Hop 1 from Wave 4 park bc1qw79v…83ha
+Block 960,794
+
+To bc1qhfdz…3wcx
+
+6f19b1b9…fdd235
+−2.79332251 BTC
+From Wave 4 park 1N8knQCf…qfDo
+Block 960,793
+
+To Bullish.com deposit 3CTpBmp8…2hBH, bc1qw79v…83ha, bc1q72k7…aamt +31 more
 
 HOP 2
 f37419c0…eb99d1
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 3, 09:36 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 3, 10:30 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,822.42107906 BTC

$115,082,246

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,367,182
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,809,352
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  86. source content difference between and source content +108 -23

    Added a Likely Wave 4 section attributed to Alex Thorn (388.92748828 BTC, 462 victims to 216 fresh 1:1 destinations, blocks 960,778 to 960,792) and raised the total stolen figure from 1,433.49 to 1,822.42 BTC across seven waves.

    seen · Captured here 18,644 chars
    What changed from the previous capture 131 lines 
     Blocked
 TOTAL STOLEN
 
-1,433.49359078 BTC
-
-<live-fiat-value>
-
-6 waves · Jul 30 – Aug 2 UTC
+1,822.42107906 BTC
+
+<live-fiat-value>
+
+7 waves · Jul 30 – Aug 3 UTC
 
 0
 300
 900
 1,200
 1,500
+1,800
+2,100
 Jul 30
 Jul 31
 Aug 1
 Aug 2
+Aug 3
 JUL 30
 Galaxy Wave 1 · July 30
 +1,082.65 BTC
 Early Aug 2 consolidation
 +64.90947964 BTC
 <live-fiat-value>
+AUG 3
+Likely Wave 4 · Aug 3
++388.92748828 BTC
+<live-fiat-value>
 
 STILL HELD
 
-99.91%
-
-of 1,410.06767965 BTC consolidated
+99.92%
+
+of 1,436.62417755 BTC consolidated
 
 BALANCE ON WATCH
 
-1,408.86663458 BTC
+1,435.42312702 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20104507 BTC
+1.20105053 BTC
 
 Reported consolidation has left the holding addresses
 
 
 Block 960,669
 
-0.269792 BTC from Hop 2 · bc1qt8…5y4k
+0.269792 BTC from Hop 2 from Hop 1 from Evening vault
 
 Watched holdings
 
-About 1,433.49359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,410.06767965 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~23.42591113 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,822.42107906 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,436.62417755 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~385.79690151 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02025933 BTC
-<live-fiat-value>
-	562.02021083 BTC	17	HELD
+	bc1qq85v2c…3fcu9r	562.02025387 BTC
+<live-fiat-value>
+	562.02021083 BTC	16	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 	bc1q0rvn88…jf5q6m	64.90373764 BTC
 <live-fiat-value>
 	64.90373764 BTC	1	HELD
+LIKELY WAVE 4 · AUG 3
+Source
+
+Alex Thorn (Galaxy research head): likely Coldcard wave — elevated sweep rate, zero pre-firmware-boundary inputs, 1:1 fresh destinations (no collector). Low fee (~1–3 sat/vB) + RBF opt-in. Watched parks are a sparse still-held sample; full victim/destination lists linked below.
+
+SCOPE
+388.92748828 BTC · 218 txs
+462 victims → 216 dests
+BLOCKS
+960,778–960,792
+FEE
+~1–3 sat/vB
+RBF opt-in
+PATTERN
+1:1 victim → fresh dest
+no collector funnel
+FULL LISTS
+Confirmed addresses
+Mempool / RBF list at report
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	bc1q05g20l…nju0ml	8.55600708 BTC
+<live-fiat-value>
+	8.55600708 BTC	1	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	bc1qjenjhm…mv4z23	5.07348539 BTC
+<live-fiat-value>
+	5.07348539 BTC	1	HELD
+
+Wave 4 park
+Received two sweeps; partial 2nd-hop already underway at add
+	1N8knQCfjq…WVqfDo	5.61303754 BTC
+<live-fiat-value>
+	5.61303754 BTC	0	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	342L6n3b61…TSjZtz	2.02374869 BTC
+<live-fiat-value>
+	2.02374869 BTC	0	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	bc1q65e6cd…yce9u8	1.14852067 BTC
+<live-fiat-value>
+	1.14852067 BTC	1	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	36XfMDAYuC…1F1x3G	1.09429601 BTC
+<live-fiat-value>
+	1.09429601 BTC	0	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	bc1qcmnjt0…rfjvtl	1.04998888 BTC
+<live-fiat-value>
+	1.04998888 BTC	1	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	bc1pj7f355…4sulc2	1.03514173 BTC
+<live-fiat-value>
+	1.03514173 BTC	1	HELD
+
+Wave 4 park
+1:1 destination sample (still held at add)
+	34nHYNnc9D…jP4qDQ	0.96227191 BTC
+<live-fiat-value>
+	0.96227191 BTC	0	HELD
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 HOP 2
 f37419c0…eb99d1
 −0.269792 BTC
-From Hop 2 · bc1qt8…5y4k bc1qt8ca…5y4k
+From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
 Block 960,669
 
 To bc1qdt6c…srqw
 HOP 1
 61c0ddac…98c095
 −0.509799 BTC
-From Hop 1 · bc1qu2…6srw bc1qu2uq…6srw
+From Hop 1 from Evening vault bc1qu2uq…6srw
 Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
 HOP 2
 49dd2935…d49564
 −0.24 BTC
-From Hop 2 · bc1qzk…6e4z bc1qzkap…6e4z
+From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
 Block 960,668
 
 To bc1qprkj…jr98
 HOP 2
 3cf126ca…10ae88
 −0.44999667 BTC
-From Hop 2 · 3P3K2M…Lfgy 3P3K2MQw…Lfgy
+From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
 Block 960,666
 
 To P2SH service hub 3KMmeqPe…qtc8
 HOP 1
 a7bf30f0…92fdec
 −0.45 BTC
-From Hop 1 · bc1qsd…jah8 bc1qsd9t…jah8
+From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
 Block 960,663
 
 To 3P3K2MQw…Lfgy
 HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
-From Hop 2 · 36c8ap…QW35 36c8aprK…QW35
+From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
 Block 960,661
 
 To P2SH service hub 3KMmeqPe…qtc8
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
 Block 960,658
 
 To 36c8aprK…QW35
 
 Aug 1 morning wave: duress-wallet honey pot swept into a ~0.33 BTC vault; Mk4 attribution later corrected to Mk3-origin seed.
 
+Alex Thorn · Likely Wave 4
+
+Aug 3: likely 4th organized wave — ~388.93 BTC confirmed (blocks 960778–960792), 462 victims → 216 fresh 1:1 destinations; full address lists on Pastebin (confirmed + mempool/RBF).
+
 Marius Offchain
 
 Early Aug 2 consolidation (04:03 UTC): ~65 BTC from ~795 addresses into one vault (community Mk2 drain report); not a Galaxy-published wave.
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 08:11 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 3, 09:36 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,822.42107906 BTC

$114,998,415

7 waves · Jul 30 – Aug 3 UTC

0
300
600
900
1,200
1,500
1,800
2,100
Jul 30
Jul 31
Aug 1
Aug 2
Aug 3
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,317,380
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,805,848
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  87. source content difference between and source content +17 -13

    Expanded the ETH rail from about 0.24 to about 11.7 ETH with a traced path through vanity hops into a 23 ETH KuCoin deposit, and added Erik, a Mk3 testing-device victim swept in the early Aug 2 consolidation.

    seen · Captured here 16,594 chars
    What changed from the previous capture 30 lines 
     
 BALANCE ON WATCH
 
-1,408.86660989 BTC
+1,408.86663458 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20106976 BTC
+1.20104507 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02024352 BTC
-<live-fiat-value>
-	562.02021083 BTC	16	HELD
+	bc1qq85v2c…3fcu9r	562.02025933 BTC
+<live-fiat-value>
+	562.02021083 BTC	17	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.45057866 BTC
-<live-fiat-value>
-	32.4505632 BTC	162	HELD
+	bc1qnk4zh9…8fecp0	32.45058754 BTC
+<live-fiat-value>
+	32.4505632 BTC	163	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
 
 BTC · ~0.69
 Aug 1 hop vault→3KMmeqPe… hub · likely custodial/swap deposit — hops already mixed out; stolen BTC effectively gone from watchable stack
-ETH · ~0.24
-Evening vault→THOR→0x6A08…→0xC61F… · also ~3.6 ETH via Orbiter Bridge 3 peels
+ETH · ~11.7
+Evening vault→THOR→0x6A08…→0xC61F…→vanity hops→KuCoin 17 · emptied Aug 2 20:29 UTC (~11.70 ETH); consolidated with ~11.08 ETH from a parallel stack into a 23 ETH deposit; also funded via Orbiter Bridge 3 peels
 Sibling ~0.27 BTC still at bc1qdt6c…
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Jul 31 consolidation (~0.51 BTC). Emptied Aug 2 — see ETH rail in flow above
+Jul 31 consolidation (~0.51 BTC). Emptied Aug 2 via THOR→ETH; ETH park 0xC61F emptied Aug 2 20:29 UTC into vanity hops → KuCoin 17
 	bc1q7rmsw0…lrrcgf	0.00 BTC
 <live-fiat-value>
 	0.50980268 BTC	0	EMPTIED
 EARLY AUG 2 CONSOLIDATION
 Source
 
-Distinct fee/structure from Galaxy Waves 1–3. Community Mk2 victim report; sampled inputs long-dormant and funded after the March 2021 vuln window.
+Distinct fee/structure from Galaxy Waves 1–3. Community Mk2 drain report plus a Mk3 testing-device victim in the same consolidation; sampled inputs long-dormant and funded after the March 2021 vuln window.
 
 SCOPE
 64.90947964 BTC · 902 inputs
 
 Early Aug 2 consolidation (04:03 UTC): ~65 BTC from ~795 addresses into one vault (community Mk2 drain report); not a Galaxy-published wave.
 
+Erik
+
+Mk3 testing-device victim (~9k sats, native segwit) swept in the Early Aug 2 consolidation — same tx / vault as the Marius report.
+
 Coinkite advisory
 
 Official guidance (updated Aug 1): who is exposed, fixed firmware versions, and migration steps.
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 07:59 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 08:11 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,433.49359078 BTC

$90,667,036

6 waves · Jul 30 – Aug 2 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
Aug 2
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,476,530
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,817,044
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,170,972
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  88. source content difference between and source content +20 -20

    Recast the P2SH cash-out hub as a service hub, weakened the Ocean-peel claim from a strong same-operator link to same exit venue, not proof of same operator, and described the BTC rail as a likely custodial or swap deposit.

    seen · Captured here 16,212 chars
    What changed from the previous capture 40 lines 
     
 BALANCE ON WATCH
 
-1,408.86660443 BTC
+1,408.86660989 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20107522 BTC
+1.20106976 BTC
 
 Reported consolidation has left the holding addresses
 
 
 Block 960,669
 
-0.269792 BTC from Hop 2 from Hop 1 from Evening vault
+0.269792 BTC from Hop 2 · bc1qt8…5y4k
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02023806 BTC
-<live-fiat-value>
-	562.02021083 BTC	15	HELD
+	bc1qq85v2c…3fcu9r	562.02024352 BTC
+<live-fiat-value>
+	562.02021083 BTC	16	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 EVENING WAVE · JULY 31
 Source
 
-Distinct from Galaxy Wave 2. Ocean miner peel later met stolen hops at the same P2SH hub — same-operator link; Ocean sats not counted as stolen.
+Distinct from Galaxy Wave 2. Ocean miner peel later met stolen hops at the same P2SH service hub (same exit venue, not proof of same operator); Ocean sats not counted as stolen.
 
 SCOPE
 1.20115791 BTC watched
 AUG 2 CASH-OUT · TWO RAILS
 
 BTC · ~0.69
-Aug 1 hop vault→3KMmeqPe… hub
+Aug 1 hop vault→3KMmeqPe… hub · likely custodial/swap deposit — hops already mixed out; stolen BTC effectively gone from watchable stack
 ETH · ~0.24
 Evening vault→THOR→0x6A08…→0xC61F… · also ~3.6 ETH via Orbiter Bridge 3 peels
 Sibling ~0.27 BTC still at bc1qdt6c…
 	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
-0.4998 + 0.1915 BTC stack. Emptied Aug 2 into P2SH hub — see BTC rail above. Ocean peel also met there (not in report balance)
+0.4998 + 0.1915 BTC stack. Emptied Aug 2 into likely custodial/swap P2SH hub — hops mixed out; see BTC rail above. Ocean peel also met there (not in report balance)
 	bc1qayw8nr…7w2u0s	0.00 BTC
 <live-fiat-value>
 	0.69135523 BTC	0	EMPTIED
 HOP 2
 f37419c0…eb99d1
 −0.269792 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
+From Hop 2 · bc1qt8…5y4k bc1qt8ca…5y4k
 Block 960,669
 
 To bc1qdt6c…srqw
 HOP 1
 61c0ddac…98c095
 −0.509799 BTC
-From Hop 1 from Evening vault bc1qu2uq…6srw
+From Hop 1 · bc1qu2…6srw bc1qu2uq…6srw
 Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
 HOP 2
 49dd2935…d49564
 −0.24 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
+From Hop 2 · bc1qzk…6e4z bc1qzkap…6e4z
 Block 960,668
 
 To bc1qprkj…jr98
 HOP 2
 3cf126ca…10ae88
 −0.44999667 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
+From Hop 2 · 3P3K2M…Lfgy 3P3K2MQw…Lfgy
 Block 960,666
 
-To P2SH cash-out hub 3KMmeqPe…qtc8
+To P2SH service hub 3KMmeqPe…qtc8
 
 HOP 1
 a7bf30f0…92fdec
 −0.45 BTC
-From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
+From Hop 1 · bc1qsd…jah8 bc1qsd9t…jah8
 Block 960,663
 
 To 3P3K2MQw…Lfgy
 HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
+From Hop 2 · 36c8ap…QW35 36c8aprK…QW35
 Block 960,661
 
-To P2SH cash-out hub 3KMmeqPe…qtc8
+To P2SH service hub 3KMmeqPe…qtc8
 
 5ecc3052…a8bf87
 −0.69135523 BTC
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
 Block 960,658
 
 To 36c8aprK…QW35
 
 Ocean block 960511
 
-Coinbase of block 960511 (tag OCEAN.XYZ) paid ~0.060 BTC that later touched the Aug 1 hop vault and was peeled off (not counted as stolen). That peel later hit the same P2SH cash-out (3KMmeqPe…) as the stolen evening-wave hops — strong same-operator link.
+Coinbase of block 960511 (tag OCEAN.XYZ) paid ~0.060 BTC that later touched the Aug 1 hop vault and was peeled off (not counted as stolen). That peel later hit the same P2SH service hub (3KMmeqPe…) as the stolen evening-wave hops — same exit venue, not proof of same operator.
 
 Tomer Strolight
 
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 3, 06:25 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 07:59 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,433.49359078 BTC

$90,949,434

6 waves · Jul 30 – Aug 2 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
Aug 2
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,689,812
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,832,047
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,211,995
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  89. source content difference between and source content +15 -15

    The LOWER RISK guidance now says weak passphrases are not enough, citing a BTC Sessions report of a confirmed Mk3 drain behind a two-word passphrase. Live-counter jitter and the feed and footer rendering churn also appear in the same capture.

    seen · Captured here 16,095 chars
    What changed from the previous capture 30 lines 
     
 BALANCE ON WATCH
 
-1,408.86660989 BTC
+1,408.86660443 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20106976 BTC
+1.20107522 BTC
 
 Reported consolidation has left the holding addresses
 
 
 Block 960,669
 
-0.269792 BTC from Hop 2 · bc1qt8…5y4k
+0.269792 BTC from Hop 2 from Hop 1 from Evening vault
 
 Watched holdings
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02024352 BTC
-<live-fiat-value>
-	562.02021083 BTC	16	HELD
+	bc1qq85v2c…3fcu9r	562.02023806 BTC
+<live-fiat-value>
+	562.02021083 BTC	15	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 HOP 2
 f37419c0…eb99d1
 −0.269792 BTC
-From Hop 2 · bc1qt8…5y4k bc1qt8ca…5y4k
+From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
 Block 960,669
 
 To bc1qdt6c…srqw
 HOP 1
 61c0ddac…98c095
 −0.509799 BTC
-From Hop 1 · bc1qu2…6srw bc1qu2uq…6srw
+From Hop 1 from Evening vault bc1qu2uq…6srw
 Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
 HOP 2
 49dd2935…d49564
 −0.24 BTC
-From Hop 2 · bc1qzk…6e4z bc1qzkap…6e4z
+From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
 Block 960,668
 
 To bc1qprkj…jr98
 HOP 2
 3cf126ca…10ae88
 −0.44999667 BTC
-From Hop 2 · 3P3K2M…Lfgy 3P3K2MQw…Lfgy
+From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
 Block 960,666
 
 To P2SH cash-out hub 3KMmeqPe…qtc8
 HOP 1
 a7bf30f0…92fdec
 −0.45 BTC
-From Hop 1 · bc1qsd…jah8 bc1qsd9t…jah8
+From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
 Block 960,663
 
 To 3P3K2MQw…Lfgy
 HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
-From Hop 2 · 36c8ap…QW35 36c8aprK…QW35
+From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
 Block 960,661
 
 To P2SH cash-out hub 3KMmeqPe…qtc8
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
 Block 960,658
 
 To 36c8aprK…QW35
 BEYOND THE MAIN SEED
 Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not a safe bet — still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not enough — BTC Sessions reported a confirmed Mk3 drain with a two-word passphrase. Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 05:22 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 3, 06:25 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,433.49359078 BTC

$91,177,360

6 waves · Jul 30 – Aug 2 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
Aug 2
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,861,953
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,844,157
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,245,105
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  90. source content difference between and source content +8 -6

    Added a MIGRATE BEFORE YOU UPGRADE section warning that the hotfix can brick a unit whose weak seed is its only signer, citing community reports including Jameson Lopp. Live counters and the footer snapshot timestamp also moved in the same capture.

    seen · Captured here 15,947 chars
    What changed from the previous capture 14 lines 
     
 BALANCE ON WATCH
 
-1,408.86660358 BTC
+1,408.86660989 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20107607 BTC
+1.20106976 BTC
 
 Reported consolidation has left the holding addresses
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02023721 BTC
-<live-fiat-value>
-	562.02021083 BTC	15	HELD
+	bc1qq85v2c…3fcu9r	562.02024352 BTC
+<live-fiat-value>
+	562.02021083 BTC	16	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47576357 BTC
 Edge (Q)	Before Aug 1 patch	6.6.0QX+
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
+MIGRATE BEFORE YOU UPGRADE
+If this Coldcard is your only signer for a weak seed, move funds first. Community reports (including Jameson Lopp) flag a non-zero chance the hotfix upgrade bricks the unit. Prefer sweeping to a new seed on a second fixed device when possible.
 ORIGIN OF THE SEED
 Exposure follows where the seed was generated, not the device holding it today. Seeds imported elsewhere, or whose origin you cannot establish, should be treated as affected.
 BEYOND THE MAIN SEED
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 02:56 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 3, 04:07 AM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,433.49359078 BTC

$90,879,193

6 waves · Jul 30 – Aug 2 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
Aug 2
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,636,762
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,828,316
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,201,791
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  91. source content difference between and source content +113 -57

    The tracker added a sixth wave, an early Aug 2 consolidation of 64.90947964 BTC from about 795 addresses into one vault attributed to a community Mk2 report by Marius Offchain, raising its headline total from 1,368.58411114 to 1,433.49359078 BTC. It also added an Aug 2 cash-out section describing BTC and ETH (THORChain, Orbiter) rails and restructured each wave summary into SCOPE/BLOCKS/FEE fields.

    seen · Captured here 15,675 chars
    What changed from the previous capture 170 lines 
     Blocked
 TOTAL STOLEN
 
-1,368.58411114 BTC
-
-<live-fiat-value>
-
-5 waves · Jul 30 – Aug 1 UTC
+1,433.49359078 BTC
+
+<live-fiat-value>
+
+6 waves · Jul 30 – Aug 2 UTC
 
 0
 300
 Jul 30
 Jul 31
 Aug 1
+Aug 2
 JUL 30
 Galaxy Wave 1 · July 30
 +1,082.65 BTC
 Morning wave · Aug 1
 +0.33295323 BTC
 <live-fiat-value>
+AUG 2
+Early Aug 2 consolidation
++64.90947964 BTC
+<live-fiat-value>
 
 STILL HELD
 
 99.91%
 
-of 1,345.16394201 BTC consolidated
+of 1,410.06767965 BTC consolidated
 
 BALANCE ON WATCH
 
-1,343.9627841 BTC
+1,408.86654358 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-1.20115791 BTC
+1.20113607 BTC
 
 Reported consolidation has left the holding addresses
 
 
 Block 960,669
 
-0.269792 BTC from Hop 2 from Hop 1 from Evening vault
+0.269792 BTC from Hop 2 · bc1qt8…5y4k
 
 Watched holdings
 
-About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,345.16394201 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~23.42016913 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,433.49359078 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,410.06767965 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~23.42591113 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 
-Blocks 960183–960191 · fixed 30 sat/vB · four consolidation holdings.
+Four consolidation holdings. Multi-path key-scan signature (BIP-84/49/44).
 
 SCOPE
 1,082.65 BTC · 1,196 addresses
+BLOCKS
+960,183–960,191
+FEE
+30 sat/vB · no change
+30–75× median that week
 WINDOW
 July 30, 2026
 01:10:20 – 01:51:26 UTC
-BLOCKS
-960,183–960,191
-FEE SIGNATURE
-30.0 sat/vB · no change
-30–75× median that week
-VICTIM PATHS
+PATHS
 1,183 BIP-84
 7 BIP-49 · 6 BIP-44
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02021083 BTC
-<live-fiat-value>
-	562.02021083 BTC	11	HELD
+	bc1qq85v2c…3fcu9r	562.02022721 BTC
+<live-fiat-value>
+	562.02021083 BTC	14	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47575357 BTC
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.4505632 BTC
-<live-fiat-value>
-	32.4505632 BTC	160	HELD
+	bc1qnk4zh9…8fecp0	32.45056866 BTC
+<live-fiat-value>
+	32.4505632 BTC	161	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
-Blocks 960345–960369 · 1,478 addresses · fees 50 and 10 sat/vB. ~45.90 BTC consolidated to the watched vault; ~30.18 BTC still at the unmoved collector.
-
+Two fee bands into a watched vault plus an unmoved collector.
+
+SCOPE
+76.16 BTC · 1,478 addresses
+BLOCKS
+960,345–960,369
+FEE
+50 and 10 sat/vB
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 2 vault
-Consolidated from 1,216 sweeps (via bc1qsjrf5ze…); still unspent
+Consolidated from 1,216 sweeps (via bc1qsjrf5ze…)
 	bc1qtfrwa4…numu75	45.90251994 BTC
 <live-fiat-value>
 	45.90251994 BTC	1	HELD
 
 Wave 2 collector
-Unmoved collector from 93 sweeps at ~10 sat/vB; still unspent
+Unmoved collector from 93 sweeps at ~10 sat/vB
 	bc1qmd5m5k…9n8jp6	30.18476329 BTC
 <live-fiat-value>
 	30.18476329 BTC	93	HELD
 GALAXY WAVE 3 · JUL 31–AUG 1 · 78 vaults
 Source
 
-Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 78 higher-value fingerprint matches (≥ 0.5 BTC each, ~184.97 BTC) — see attribution below.
-
-WHY THESE LOOK LIKE STOLEN WAVE 3 FUNDS
-
-Not Galaxy’s published address list. Matched their Wave 3 fingerprint (blocks 960396–960471, ~180–220 sat/vB, park → P2WSH vault), cross-checked against the public COLDCARD RNG chain map, then kept only higher-value vaults (≥ 0.5 BTC) so the cron snapshot stays reliable on public explorers. Smaller vaults are omitted on purpose. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
-
-WATCHED
-78 P2WSH vaults · 184.97366201 BTC
-≥ 0.50 BTC each · snapshot · Galaxy ~293 / ~207.73 BTC
+Not Galaxy’s published list — fingerprint-matched + RNG chain map, then ≥ 0.5 BTC only.
+
+SCOPE
+208.24 BTC · ~1,912 addresses
+Galaxy ~293 vaults / ~207.73 BTC
 BLOCKS
 960,396–960,471
-FEE WINDOW
-180–220 sat/vB · no change
+FEE
+180–220 sat/vB
 Galaxy: ~200 sat/vB
+WATCHED
+78 P2WSH · 184.97366201 BTC
+≥ 0.50 BTC each
 PATTERN
-park → P2WSH vault
-still funded at match time
+park → P2WSH
+RNG map cross-check
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Wave 3 vault 1
 EVENING WAVE · JULY 31
 Source
 
-Low-fee (~1–2 sat/vB) sweeps. Both watched holdings (~1.20 BTC) emptied Aug 1–2 and are peeling toward cash-out. Stolen hops and the Ocean (OCEAN.XYZ) miner peel that touched the Aug 1 hop vault later consolidated into the same busy P2SH (3KMmeqPe…) — same-operator link; Ocean sats not counted as stolen. Distinct from Galaxy Wave 2.
-
+Distinct from Galaxy Wave 2. Ocean miner peel later met stolen hops at the same P2SH hub — same-operator link; Ocean sats not counted as stolen.
+
+SCOPE
+1.20115791 BTC watched
+emptied Aug 1–2
+FEE
+~1–2 sat/vB
+
+AUG 2 CASH-OUT · TWO RAILS
+
+BTC · ~0.69
+Aug 1 hop vault→3KMmeqPe… hub
+ETH · ~0.24
+Evening vault→THOR→0x6A08…→0xC61F… · also ~3.6 ETH via Orbiter Bridge 3 peels
+Sibling ~0.27 BTC still at bc1qdt6c…
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Jul 31 consolidation (~0.51 BTC). Emptied Aug 2; onward peels in progress
+Jul 31 consolidation (~0.51 BTC). Emptied Aug 2 — see ETH rail in flow above
 	bc1q7rmsw0…lrrcgf	0.00 BTC
 <live-fiat-value>
 	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
-0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. Emptied Aug 2. Ocean miner peel from here later met stolen hops at the same P2SH cash-out (3KMmeqPe…) — not part of this report balance
+0.4998 + 0.1915 BTC stack. Emptied Aug 2 into P2SH hub — see BTC rail above. Ocean peel also met there (not in report balance)
 	bc1qayw8nr…7w2u0s	0.00 BTC
 <live-fiat-value>
 	0.69135523 BTC	0	EMPTIED
 MORNING WAVE · AUG 1
 Source
 
-Blocks 960518–960523. Direct victim sweeps (~15–50 sat/vB) into one vault; honey-pot / duress-wallet report (Mk4 claim later withdrawn — seed was Mk3-origin).
-
+Honey-pot / duress-wallet report. Mk4 claim later withdrawn — seed was Mk3-origin.
+
+SCOPE
+0.33295323 BTC
+BLOCKS
+960,518–960,523
+FEE
+~15–50 sat/vB
+PATTERN
+direct victim → vault
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Aug 1 vault
-0.33203236 BTC from 16 victim sweeps; still unspent
 	bc1qzm5pau…v34mf3	0.33203236 BTC
 <live-fiat-value>
 	0.33203236 BTC	16	HELD
+EARLY AUG 2 CONSOLIDATION
+Source
+
+Distinct fee/structure from Galaxy Waves 1–3. Community Mk2 victim report; sampled inputs long-dormant and funded after the March 2021 vuln window.
+
+SCOPE
+64.90947964 BTC · 902 inputs
+795 addresses
+BLOCKS
+960,668
+FEE
+~9 sat/vB
+WINDOW
+04:03 UTC Aug 2
+PATTERN
+multi-path → one P2WPKH
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Aug 2 vault
+	bc1q0rvn88…jf5q6m	64.90373764 BTC
+<live-fiat-value>
+	64.90373764 BTC	1	HELD
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 HOP 2
 f37419c0…eb99d1
 −0.269792 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qt8ca…5y4k
+From Hop 2 · bc1qt8…5y4k bc1qt8ca…5y4k
 Block 960,669
 
 To bc1qdt6c…srqw
 HOP 1
 61c0ddac…98c095
 −0.509799 BTC
-From Hop 1 from Evening vault bc1qu2uq…6srw
+From Hop 1 · bc1qu2…6srw bc1qu2uq…6srw
 Block 960,668
 
 To bc1qt8ca…5y4k, bc1qzkap…6e4z
 HOP 2
 49dd2935…d49564
 −0.24 BTC
-From Hop 2 from Hop 1 from Evening vault bc1qzkap…6e4z
+From Hop 2 · bc1qzk…6e4z bc1qzkap…6e4z
 Block 960,668
 
 To bc1qprkj…jr98
 HOP 2
 3cf126ca…10ae88
 −0.44999667 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 3P3K2MQw…Lfgy
+From Hop 2 · 3P3K2M…Lfgy 3P3K2MQw…Lfgy
 Block 960,666
 
-To 3KMmeqPe…qtc8
+To P2SH cash-out hub 3KMmeqPe…qtc8
 
 HOP 1
 a7bf30f0…92fdec
 −0.45 BTC
-From Hop 1 from Aug 1 hop vault bc1qsd9t…jah8
+From Hop 1 · bc1qsd…jah8 bc1qsd9t…jah8
 Block 960,663
 
 To 3P3K2MQw…Lfgy
 HOP 2
 d0bcdc4a…33c0a0
 −0.24134867 BTC
-From Hop 2 from Hop 1 from Aug 1 hop vault 36c8aprK…QW35
+From Hop 2 · 36c8ap…QW35 36c8aprK…QW35
 Block 960,661
 
-To 3KMmeqPe…qtc8
+To P2SH cash-out hub 3KMmeqPe…qtc8
 
 5ecc3052…a8bf87
 −0.69135523 BTC
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
+From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
 Block 960,658
 
 To 36c8aprK…QW35
 
 Aug 1 morning wave: duress-wallet honey pot swept into a ~0.33 BTC vault; Mk4 attribution later corrected to Mk3-origin seed.
 
+Marius Offchain
+
+Early Aug 2 consolidation (04:03 UTC): ~65 BTC from ~795 addresses into one vault (community Mk2 drain report); not a Galaxy-published wave.
+
 Coinkite advisory
 
 Official guidance (updated Aug 1): who is exposed, fixed firmware versions, and migration steps.
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via snapshot; Wave 3 from cron snapshot (Aug 2, 08:33 PM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (Aug 2, 10:56 PM). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Blocked
TOTAL STOLEN

1,433.49359078 BTC

$90,318,697

6 waves · Jul 30 – Aug 2 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
Aug 2
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,213,446
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,798,537
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,120,369
JUL 31
Evening wave · July 31

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  92. source content difference between and source content +76 -56

    The Wave 3 watch list grew from 74 to 78 vaults (about 184.97 BTC) with four newly added vaults, and the attribution text now says the matches were cross-checked against the public COLDCARD RNG chain map.

    seen · Captured here 15,617 chars
    What changed from the previous capture 132 lines 
     
 99.91%
 
-of 1,340.42626197 BTC consolidated
+of 1,345.16394201 BTC consolidated
 
 BALANCE ON WATCH
 
-1,339.22510406 BTC
+1,343.9627841 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,340.42626197 BTC is in watched holdings (core vaults live-polled; 74 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~28.15784917 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,345.16394201 BTC is in watched holdings (core vaults live-polled; 78 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~23.42016913 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 	bc1qmd5m5k…9n8jp6	30.18476329 BTC
 <live-fiat-value>
 	30.18476329 BTC	93	HELD
-GALAXY WAVE 3 · JUL 31–AUG 1 · 74 vaults
+GALAXY WAVE 3 · JUL 31–AUG 1 · 78 vaults
 Source
 
-Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 74 higher-value fingerprint matches (≥ 0.5 BTC each, ~180.24 BTC) — see attribution below.
+Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 78 higher-value fingerprint matches (≥ 0.5 BTC each, ~184.97 BTC) — see attribution below.
 
 WHY THESE LOOK LIKE STOLEN WAVE 3 FUNDS
 
-Not Galaxy’s published address list. Matched their Wave 3 fingerprint (blocks 960396–960471, ~180–220 sat/vB, fresh park → P2WSH vault), then kept only higher-value vaults (≥ 0.5 BTC) so the cron snapshot stays reliable on public explorers. Smaller matched vaults are omitted on purpose. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
+Not Galaxy’s published address list. Matched their Wave 3 fingerprint (blocks 960396–960471, ~180–220 sat/vB, park → P2WSH vault), cross-checked against the public COLDCARD RNG chain map, then kept only higher-value vaults (≥ 0.5 BTC) so the cron snapshot stays reliable on public explorers. Smaller vaults are omitted on purpose. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
 
 WATCHED
-74 P2WSH vaults · 180.23598197 BTC
+78 P2WSH vaults · 184.97366201 BTC
 ≥ 0.50 BTC each · snapshot · Galaxy ~293 / ~207.73 BTC
 BLOCKS
 960,396–960,471
 	2.20411992 BTC	1	HELD
 
 Wave 3 vault 26
+	bc1q4jg9dq…7pmdnh	2.18639261 BTC
+<live-fiat-value>
+	2.18639261 BTC	1	HELD
+
+Wave 3 vault 27
 	bc1qvlaxcm…9kqr94	2.08421608 BTC
 <live-fiat-value>
 	2.08421608 BTC	1	HELD
 
-Wave 3 vault 27
+Wave 3 vault 28
 	bc1qmfyggr…lq084x	2.05746782 BTC
 <live-fiat-value>
 	2.05746782 BTC	1	HELD
 
-Wave 3 vault 28
+Wave 3 vault 29
 	bc1qr4jfp7…4ylgjt	2.02848692 BTC
 <live-fiat-value>
 	2.02848692 BTC	1	HELD
 
-Wave 3 vault 29
+Wave 3 vault 30
 	bc1q4x7ydy…urffxu	1.73373065 BTC
 <live-fiat-value>
 	1.73373065 BTC	1	HELD
 
-Wave 3 vault 30
+Wave 3 vault 31
 	bc1qkz22xl…ulkacd	1.69188357 BTC
 <live-fiat-value>
 	1.69188357 BTC	1	HELD
 
-Wave 3 vault 31
+Wave 3 vault 32
 	bc1qmhhm9s…m58kkh	1.68228991 BTC
 <live-fiat-value>
 	1.68228991 BTC	1	HELD
 
-Wave 3 vault 32
+Wave 3 vault 33
 	bc1qkaqcsw…9j8lch	1.58669331 BTC
 <live-fiat-value>
 	1.58669331 BTC	1	HELD
 
-Wave 3 vault 33
+Wave 3 vault 34
 	bc1qxkpyzk…tkfqla	1.51069414 BTC
 <live-fiat-value>
 	1.51069414 BTC	1	HELD
 
-Wave 3 vault 34
+Wave 3 vault 35
 	bc1qj3jd8y…j5v27w	1.42355164 BTC
 <live-fiat-value>
 	1.42355164 BTC	1	HELD
 
-Wave 3 vault 35
+Wave 3 vault 36
 	bc1qxuva8w…uddrs5	1.2984018 BTC
 <live-fiat-value>
 	1.2984018 BTC	1	HELD
 
-Wave 3 vault 36
+Wave 3 vault 37
+	bc1q3jnv88…0yqva7	1.29341473 BTC
+<live-fiat-value>
+	1.29341473 BTC	1	HELD
+
+Wave 3 vault 38
 	bc1q2q8epf…6h0lm2	1.24272696 BTC
 <live-fiat-value>
 	1.24272696 BTC	1	HELD
 
-Wave 3 vault 37
+Wave 3 vault 39
 	bc1qtwx5m0…jfyxru	1.14238463 BTC
 <live-fiat-value>
 	1.14238463 BTC	1	HELD
 
-Wave 3 vault 38
+Wave 3 vault 40
 	bc1qfgv6py…s4h9ae	1.10389012 BTC
 <live-fiat-value>
 	1.10389012 BTC	1	HELD
 
-Wave 3 vault 39
+Wave 3 vault 41
 	bc1qwy642m…65xj4s	1.05327357 BTC
 <live-fiat-value>
 	1.05327357 BTC	1	HELD
 
-Wave 3 vault 40
+Wave 3 vault 42
 	bc1qtu8suv…4eg09u	1.0430298 BTC
 <live-fiat-value>
 	1.0430298 BTC	1	HELD
 
-Wave 3 vault 41
+Wave 3 vault 43
 	bc1qcu3w05…etphx4	1.01976357 BTC
 <live-fiat-value>
 	1.01976357 BTC	1	HELD
 
-Wave 3 vault 42
+Wave 3 vault 44
 	bc1q3ehq9t…a5yh8j	1.01857988 BTC
 <live-fiat-value>
 	1.01857988 BTC	1	HELD
 
-Wave 3 vault 43
+Wave 3 vault 45
 	bc1qqu0sp6…ltw5ac	1.01266757 BTC
 <live-fiat-value>
 	1.01266757 BTC	1	HELD
 
-Wave 3 vault 44
+Wave 3 vault 46
 	bc1qsjltn7…zc0szd	1.0069355 BTC
 <live-fiat-value>
 	1.0069355 BTC	1	HELD
 
-Wave 3 vault 45
+Wave 3 vault 47
 	bc1qtl628t…wh9r2j	1.00093255 BTC
 <live-fiat-value>
 	1.00093255 BTC	1	HELD
 
-Wave 3 vault 46
+Wave 3 vault 48
 	bc1qa3mfkw…dzd64z	1.00040325 BTC
 <live-fiat-value>
 	1.00040325 BTC	1	HELD
 
-Wave 3 vault 47
+Wave 3 vault 49
 	bc1q5c6m8q…5mgfa2	1.0001318 BTC
 <live-fiat-value>
 	1.0001318 BTC	1	HELD
 
-Wave 3 vault 48
+Wave 3 vault 50
 	bc1qt2k74x…3kf758	0.9949898 BTC
 <live-fiat-value>
 	0.9949898 BTC	1	HELD
 
-Wave 3 vault 49
+Wave 3 vault 51
 	bc1q7fgsar…msv9fj	0.9934878 BTC
 <live-fiat-value>
 	0.9934878 BTC	1	HELD
 
-Wave 3 vault 50
+Wave 3 vault 52
 	bc1qrx4r4d…kutf0n	0.85192202 BTC
 <live-fiat-value>
 	0.85192202 BTC	1	HELD
 
-Wave 3 vault 51
+Wave 3 vault 53
 	bc1q464usw…slhtk0	0.85074447 BTC
 <live-fiat-value>
 	0.85074447 BTC	1	HELD
 
-Wave 3 vault 52
+Wave 3 vault 54
 	bc1qkl4vkx…hglgc2	0.83717676 BTC
 <live-fiat-value>
 	0.83717676 BTC	1	HELD
 
-Wave 3 vault 53
+Wave 3 vault 55
 	bc1q893u28…2p64rx	0.8353508 BTC
 <live-fiat-value>
 	0.8353508 BTC	1	HELD
 
-Wave 3 vault 54
+Wave 3 vault 56
 	bc1q75t6ku…ue6rl2	0.81458411 BTC
 <live-fiat-value>
 	0.81458411 BTC	1	HELD
 
-Wave 3 vault 55
+Wave 3 vault 57
 	bc1qc5j2jg…822mln	0.80094372 BTC
 <live-fiat-value>
 	0.80094372 BTC	1	HELD
 
-Wave 3 vault 56
+Wave 3 vault 58
 	bc1qnjpfhc…a8tqc5	0.77812263 BTC
 <live-fiat-value>
 	0.77812263 BTC	1	HELD
 
-Wave 3 vault 57
+Wave 3 vault 59
 	bc1q64nmnz…su2td0	0.77291101 BTC
 <live-fiat-value>
 	0.77291101 BTC	1	HELD
 
-Wave 3 vault 58
+Wave 3 vault 60
 	bc1qassuuk…hh93zs	0.7596758 BTC
 <live-fiat-value>
 	0.7596758 BTC	1	HELD
 
-Wave 3 vault 59
+Wave 3 vault 61
 	bc1qxhju5x…h2snjc	0.75536701 BTC
 <live-fiat-value>
 	0.75536701 BTC	1	HELD
 
-Wave 3 vault 60
+Wave 3 vault 62
 	bc1qq2y3q0…gjpzkl	0.70431447 BTC
 <live-fiat-value>
 	0.70431447 BTC	1	HELD
 
-Wave 3 vault 61
+Wave 3 vault 63
+	bc1q22envz…5knnwx	0.70394873 BTC
+<live-fiat-value>
+	0.70394873 BTC	1	HELD
+
+Wave 3 vault 64
 	bc1q6vc45u…9yklv7	0.69906337 BTC
 <live-fiat-value>
 	0.69906337 BTC	1	HELD
 
-Wave 3 vault 62
+Wave 3 vault 65
 	bc1qrmp5a6…7z8w8m	0.67899409 BTC
 <live-fiat-value>
 	0.67899409 BTC	1	HELD
 
-Wave 3 vault 63
+Wave 3 vault 66
 	bc1qu673md…hz5ztq	0.66510239 BTC
 <live-fiat-value>
 	0.66510239 BTC	1	HELD
 
-Wave 3 vault 64
+Wave 3 vault 67
 	bc1qhvrd93…ptvlfn	0.64598208 BTC
 <live-fiat-value>
 	0.64598208 BTC	1	HELD
 
-Wave 3 vault 65
+Wave 3 vault 68
 	bc1q0pyh8m…3m6nkf	0.61847292 BTC
 <live-fiat-value>
 	0.61847292 BTC	1	HELD
 
-Wave 3 vault 66
+Wave 3 vault 69
 	bc1q5k77u9…lddty4	0.5941699 BTC
 <live-fiat-value>
 	0.5941699 BTC	1	HELD
 
-Wave 3 vault 67
+Wave 3 vault 70
 	bc1qmkqkq6…l4mgyu	0.58741437 BTC
 <live-fiat-value>
 	0.58741437 BTC	1	HELD
 
-Wave 3 vault 68
+Wave 3 vault 71
 	bc1qwymjp7…3u33zw	0.58633145 BTC
 <live-fiat-value>
 	0.58633145 BTC	1	HELD
 
-Wave 3 vault 69
+Wave 3 vault 72
 	bc1qm2de6c…mnq34p	0.5808048 BTC
 <live-fiat-value>
 	0.5808048 BTC	1	HELD
 
-Wave 3 vault 70
+Wave 3 vault 73
+	bc1qcwcxxp…5g6ygk	0.55392397 BTC
+<live-fiat-value>
+	0.55392397 BTC	1	HELD
+
+Wave 3 vault 74
 	bc1q6vpkjw…37udc6	0.54963327 BTC
 <live-fiat-value>
 	0.54963327 BTC	1	HELD
 
-Wave 3 vault 71
+Wave 3 vault 75
 	bc1qtujm6u…wpqs6r	0.54569989 BTC
 <live-fiat-value>
 	0.54569989 BTC	1	HELD
 
-Wave 3 vault 72
+Wave 3 vault 76
 	bc1qfeg6uq…a58my8	0.54132885 BTC
 <live-fiat-value>
 	0.54132885 BTC	1	HELD
 
-Wave 3 vault 73
+Wave 3 vault 77
 	bc1qkwhtgu…t8n5zl	0.5069498 BTC
 <live-fiat-value>
 	0.5069498 BTC	1	HELD
 
-Wave 3 vault 74
+Wave 3 vault 78
 	bc1qkyncy6…sw293h	0.50163823 BTC
 <live-fiat-value>
 	0.50163823 BTC	1	HELD
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 13:02). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 13:21). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,729,912

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,609,696
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,826,412
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,196,585
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  93. source content difference between and source content +109 -114

    The tracker removed the 1.05 BTC vault bc1qm5z7e2 from its Wave 3 watch list, cutting the count from 75 to 74 vaults and the watched total to 180.23598197 BTC with no matching movement-feed entry, a delisting rather than a spend.

    seen · Captured here 15,246 chars
    What changed from the previous capture 223 lines 
     
 99.91%
 
-of 1,341.47626197 BTC consolidated
+of 1,340.42626197 BTC consolidated
 
 BALANCE ON WATCH
 
-1,340.27510406 BTC
+1,339.22510406 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,341.47626197 BTC is in watched holdings (core vaults live-polled; 75 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~27.10784917 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,340.42626197 BTC is in watched holdings (core vaults live-polled; 74 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~28.15784917 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 	bc1qmd5m5k…9n8jp6	30.18476329 BTC
 <live-fiat-value>
 	30.18476329 BTC	93	HELD
-GALAXY WAVE 3 · JUL 31–AUG 1 · 75 vaults
+GALAXY WAVE 3 · JUL 31–AUG 1 · 74 vaults
 Source
 
-Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 75 higher-value fingerprint matches (≥ 0.5 BTC each, ~181.29 BTC) — see attribution below.
+Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 74 higher-value fingerprint matches (≥ 0.5 BTC each, ~180.24 BTC) — see attribution below.
 
 WHY THESE LOOK LIKE STOLEN WAVE 3 FUNDS
 
 Not Galaxy’s published address list. Matched their Wave 3 fingerprint (blocks 960396–960471, ~180–220 sat/vB, fresh park → P2WSH vault), then kept only higher-value vaults (≥ 0.5 BTC) so the cron snapshot stays reliable on public explorers. Smaller matched vaults are omitted on purpose. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
 
 WATCHED
-75 P2WSH vaults · 181.28598197 BTC
+74 P2WSH vaults · 180.23598197 BTC
 ≥ 0.50 BTC each · snapshot · Galaxy ~293 / ~207.73 BTC
 BLOCKS
 960,396–960,471
 	1.05327357 BTC	1	HELD
 
 Wave 3 vault 40
-	bc1qm5z7e2…se2vd9	1.05 BTC
-<live-fiat-value>
-	1.05 BTC	1	HELD
+	bc1qtu8suv…4eg09u	1.0430298 BTC
+<live-fiat-value>
+	1.0430298 BTC	1	HELD
 
 Wave 3 vault 41
-	bc1qtu8suv…4eg09u	1.0430298 BTC
-<live-fiat-value>
-	1.0430298 BTC	1	HELD
+	bc1qcu3w05…etphx4	1.01976357 BTC
+<live-fiat-value>
+	1.01976357 BTC	1	HELD
 
 Wave 3 vault 42
-	bc1qcu3w05…etphx4	1.01976357 BTC
-<live-fiat-value>
-	1.01976357 BTC	1	HELD
+	bc1q3ehq9t…a5yh8j	1.01857988 BTC
+<live-fiat-value>
+	1.01857988 BTC	1	HELD
 
 Wave 3 vault 43
-	bc1q3ehq9t…a5yh8j	1.01857988 BTC
-<live-fiat-value>
-	1.01857988 BTC	1	HELD
+	bc1qqu0sp6…ltw5ac	1.01266757 BTC
+<live-fiat-value>
+	1.01266757 BTC	1	HELD
 
 Wave 3 vault 44
-	bc1qqu0sp6…ltw5ac	1.01266757 BTC
-<live-fiat-value>
-	1.01266757 BTC	1	HELD
+	bc1qsjltn7…zc0szd	1.0069355 BTC
+<live-fiat-value>
+	1.0069355 BTC	1	HELD
 
 Wave 3 vault 45
-	bc1qsjltn7…zc0szd	1.0069355 BTC
-<live-fiat-value>
-	1.0069355 BTC	1	HELD
+	bc1qtl628t…wh9r2j	1.00093255 BTC
+<live-fiat-value>
+	1.00093255 BTC	1	HELD
 
 Wave 3 vault 46
-	bc1qtl628t…wh9r2j	1.00093255 BTC
-<live-fiat-value>
-	1.00093255 BTC	1	HELD
+	bc1qa3mfkw…dzd64z	1.00040325 BTC
+<live-fiat-value>
+	1.00040325 BTC	1	HELD
 
 Wave 3 vault 47
-	bc1qa3mfkw…dzd64z	1.00040325 BTC
-<live-fiat-value>
-	1.00040325 BTC	1	HELD
+	bc1q5c6m8q…5mgfa2	1.0001318 BTC
+<live-fiat-value>
+	1.0001318 BTC	1	HELD
 
 Wave 3 vault 48
-	bc1q5c6m8q…5mgfa2	1.0001318 BTC
-<live-fiat-value>
-	1.0001318 BTC	1	HELD
+	bc1qt2k74x…3kf758	0.9949898 BTC
+<live-fiat-value>
+	0.9949898 BTC	1	HELD
 
 Wave 3 vault 49
-	bc1qt2k74x…3kf758	0.9949898 BTC
-<live-fiat-value>
-	0.9949898 BTC	1	HELD
+	bc1q7fgsar…msv9fj	0.9934878 BTC
+<live-fiat-value>
+	0.9934878 BTC	1	HELD
 
 Wave 3 vault 50
-	bc1q7fgsar…msv9fj	0.9934878 BTC
-<live-fiat-value>
-	0.9934878 BTC	1	HELD
+	bc1qrx4r4d…kutf0n	0.85192202 BTC
+<live-fiat-value>
+	0.85192202 BTC	1	HELD
 
 Wave 3 vault 51
-	bc1qrx4r4d…kutf0n	0.85192202 BTC
-<live-fiat-value>
-	0.85192202 BTC	1	HELD
+	bc1q464usw…slhtk0	0.85074447 BTC
+<live-fiat-value>
+	0.85074447 BTC	1	HELD
 
 Wave 3 vault 52
-	bc1q464usw…slhtk0	0.85074447 BTC
-<live-fiat-value>
-	0.85074447 BTC	1	HELD
+	bc1qkl4vkx…hglgc2	0.83717676 BTC
+<live-fiat-value>
+	0.83717676 BTC	1	HELD
 
 Wave 3 vault 53
-	bc1qkl4vkx…hglgc2	0.83717676 BTC
-<live-fiat-value>
-	0.83717676 BTC	1	HELD
+	bc1q893u28…2p64rx	0.8353508 BTC
+<live-fiat-value>
+	0.8353508 BTC	1	HELD
 
 Wave 3 vault 54
-	bc1q893u28…2p64rx	0.8353508 BTC
-<live-fiat-value>
-	0.8353508 BTC	1	HELD
+	bc1q75t6ku…ue6rl2	0.81458411 BTC
+<live-fiat-value>
+	0.81458411 BTC	1	HELD
 
 Wave 3 vault 55
-	bc1q75t6ku…ue6rl2	0.81458411 BTC
-<live-fiat-value>
-	0.81458411 BTC	1	HELD
+	bc1qc5j2jg…822mln	0.80094372 BTC
+<live-fiat-value>
+	0.80094372 BTC	1	HELD
 
 Wave 3 vault 56
-	bc1qc5j2jg…822mln	0.80094372 BTC
-<live-fiat-value>
-	0.80094372 BTC	1	HELD
+	bc1qnjpfhc…a8tqc5	0.77812263 BTC
+<live-fiat-value>
+	0.77812263 BTC	1	HELD
 
 Wave 3 vault 57
-	bc1qnjpfhc…a8tqc5	0.77812263 BTC
-<live-fiat-value>
-	0.77812263 BTC	1	HELD
+	bc1q64nmnz…su2td0	0.77291101 BTC
+<live-fiat-value>
+	0.77291101 BTC	1	HELD
 
 Wave 3 vault 58
-	bc1q64nmnz…su2td0	0.77291101 BTC
-<live-fiat-value>
-	0.77291101 BTC	1	HELD
+	bc1qassuuk…hh93zs	0.7596758 BTC
+<live-fiat-value>
+	0.7596758 BTC	1	HELD
 
 Wave 3 vault 59
-	bc1qassuuk…hh93zs	0.7596758 BTC
-<live-fiat-value>
-	0.7596758 BTC	1	HELD
+	bc1qxhju5x…h2snjc	0.75536701 BTC
+<live-fiat-value>
+	0.75536701 BTC	1	HELD
 
 Wave 3 vault 60
-	bc1qxhju5x…h2snjc	0.75536701 BTC
-<live-fiat-value>
-	0.75536701 BTC	1	HELD
+	bc1qq2y3q0…gjpzkl	0.70431447 BTC
+<live-fiat-value>
+	0.70431447 BTC	1	HELD
 
 Wave 3 vault 61
-	bc1qq2y3q0…gjpzkl	0.70431447 BTC
-<live-fiat-value>
-	0.70431447 BTC	1	HELD
+	bc1q6vc45u…9yklv7	0.69906337 BTC
+<live-fiat-value>
+	0.69906337 BTC	1	HELD
 
 Wave 3 vault 62
-	bc1q6vc45u…9yklv7	0.69906337 BTC
-<live-fiat-value>
-	0.69906337 BTC	1	HELD
+	bc1qrmp5a6…7z8w8m	0.67899409 BTC
+<live-fiat-value>
+	0.67899409 BTC	1	HELD
 
 Wave 3 vault 63
-	bc1qrmp5a6…7z8w8m	0.67899409 BTC
-<live-fiat-value>
-	0.67899409 BTC	1	HELD
+	bc1qu673md…hz5ztq	0.66510239 BTC
+<live-fiat-value>
+	0.66510239 BTC	1	HELD
 
 Wave 3 vault 64
-	bc1qu673md…hz5ztq	0.66510239 BTC
-<live-fiat-value>
-	0.66510239 BTC	1	HELD
+	bc1qhvrd93…ptvlfn	0.64598208 BTC
+<live-fiat-value>
+	0.64598208 BTC	1	HELD
 
 Wave 3 vault 65
-	bc1qhvrd93…ptvlfn	0.64598208 BTC
-<live-fiat-value>
-	0.64598208 BTC	1	HELD
+	bc1q0pyh8m…3m6nkf	0.61847292 BTC
+<live-fiat-value>
+	0.61847292 BTC	1	HELD
 
 Wave 3 vault 66
-	bc1q0pyh8m…3m6nkf	0.61847292 BTC
-<live-fiat-value>
-	0.61847292 BTC	1	HELD
+	bc1q5k77u9…lddty4	0.5941699 BTC
+<live-fiat-value>
+	0.5941699 BTC	1	HELD
 
 Wave 3 vault 67
-	bc1q5k77u9…lddty4	0.5941699 BTC
-<live-fiat-value>
-	0.5941699 BTC	1	HELD
+	bc1qmkqkq6…l4mgyu	0.58741437 BTC
+<live-fiat-value>
+	0.58741437 BTC	1	HELD
 
 Wave 3 vault 68
-	bc1qmkqkq6…l4mgyu	0.58741437 BTC
-<live-fiat-value>
-	0.58741437 BTC	1	HELD
+	bc1qwymjp7…3u33zw	0.58633145 BTC
+<live-fiat-value>
+	0.58633145 BTC	1	HELD
 
 Wave 3 vault 69
-	bc1qwymjp7…3u33zw	0.58633145 BTC
-<live-fiat-value>
-	0.58633145 BTC	1	HELD
+	bc1qm2de6c…mnq34p	0.5808048 BTC
+<live-fiat-value>
+	0.5808048 BTC	1	HELD
 
 Wave 3 vault 70
-	bc1qm2de6c…mnq34p	0.5808048 BTC
-<live-fiat-value>
-	0.5808048 BTC	1	HELD
+	bc1q6vpkjw…37udc6	0.54963327 BTC
+<live-fiat-value>
+	0.54963327 BTC	1	HELD
 
 Wave 3 vault 71
-	bc1q6vpkjw…37udc6	0.54963327 BTC
-<live-fiat-value>
-	0.54963327 BTC	1	HELD
+	bc1qtujm6u…wpqs6r	0.54569989 BTC
+<live-fiat-value>
+	0.54569989 BTC	1	HELD
 
 Wave 3 vault 72
-	bc1qtujm6u…wpqs6r	0.54569989 BTC
-<live-fiat-value>
-	0.54569989 BTC	1	HELD
+	bc1qfeg6uq…a58my8	0.54132885 BTC
+<live-fiat-value>
+	0.54132885 BTC	1	HELD
 
 Wave 3 vault 73
-	bc1qfeg6uq…a58my8	0.54132885 BTC
-<live-fiat-value>
-	0.54132885 BTC	1	HELD
+	bc1qkwhtgu…t8n5zl	0.5069498 BTC
+<live-fiat-value>
+	0.5069498 BTC	1	HELD
 
 Wave 3 vault 74
-	bc1qkwhtgu…t8n5zl	0.5069498 BTC
-<live-fiat-value>
-	0.5069498 BTC	1	HELD
-
-Wave 3 vault 75
 	bc1qkyncy6…sw293h	0.50163823 BTC
 <live-fiat-value>
 	0.50163823 BTC	1	HELD
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 12:18). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 13:02). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,795,604

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,661,663
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,830,067
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,206,581
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  94. source content difference between and source content +16 -8

    A new hop-2 spend of 0.269792 BTC in block 960,669 became the last movement, and the evening-wave narrative was rewritten: both watched holdings emptied Aug 1-2 and stolen hops plus the Ocean miner peel consolidated into the same P2SH address 3KMmeqPe, which the tracker presents as a same-operator link.

    seen · Captured here 15,316 chars
    What changed from the previous capture 24 lines 
     
 LAST MOVEMENT
 
-Block 960,668
-
-0.509799 BTC from Hop 1 · bc1qu2…6srw
+Block 960,669
+
+0.269792 BTC from Hop 2 · bc1qt8…5y4k
 
 Watched holdings
 
 EVENING WAVE · JULY 31
 Source
 
-Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from Galaxy Wave 2.
+Low-fee (~1–2 sat/vB) sweeps. Both watched holdings (~1.20 BTC) emptied Aug 1–2 and are peeling toward cash-out. Stolen hops and the Ocean (OCEAN.XYZ) miner peel that touched the Aug 1 hop vault later consolidated into the same busy P2SH (3KMmeqPe…) — same-operator link; Ocean sats not counted as stolen. Distinct from Galaxy Wave 2.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Jul 31 consolidation, still unspent. Aug 1 pass-through tracked separately below
+Jul 31 consolidation (~0.51 BTC). Emptied Aug 2; onward peels in progress
 	bc1q7rmsw0…lrrcgf	0.00 BTC
 <live-fiat-value>
 	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
-0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. An Ocean miner payout also landed here and was spent onward — not part of this report balance
+0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. Emptied Aug 2. Ocean miner peel from here later met stolen hops at the same P2SH cash-out (3KMmeqPe…) — not part of this report balance
 	bc1qayw8nr…7w2u0s	0.00 BTC
 <live-fiat-value>
 	0.69135523 BTC	0	EMPTIED
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
+
+HOP 2
+f37419c0…eb99d1
+−0.269792 BTC
+From Hop 2 · bc1qt8…5y4k bc1qt8ca…5y4k
+Block 960,669
+
+To bc1qdt6c…srqw
 
 HOP 1
 61c0ddac…98c095
 
 Ocean block 960511
 
-Coinbase of block 960511 (tag OCEAN.XYZ) paid 0.06045759 BTC to a miner address that later sent to the Aug 1 hop vault; that UTXO was peeled off and is not counted as stolen.
+Coinbase of block 960511 (tag OCEAN.XYZ) paid ~0.060 BTC that later touched the Aug 1 hop vault and was peeled off (not counted as stolen). That peel later hit the same P2SH cash-out (3KMmeqPe…) as the stolen evening-wave hops — strong same-operator link.
 
 Tomer Strolight
 
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 11:47). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 12:18). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,873,614

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,723,374
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,834,408
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,218,450
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  95. source content difference between and source content +60 -13

    The evening vault emptied (0.50980268 BTC, now marked EMPTIED), the moved total rose to 1.20115791 BTC, and the feed added confirmed hop-1 and hop-2 spends across blocks 960,658 to 960,668, several peeling toward P2SH destinations.

    seen · Captured here 15,133 chars
    What changed from the previous capture 73 lines 
     
 STILL HELD
 
-99.95%
+99.91%
 
 of 1,341.47626197 BTC consolidated
 
 BALANCE ON WATCH
 
-1,340.78490674 BTC
+1,340.27510406 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-0.69135523 BTC
+1.20115791 BTC
 
 Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Unconfirmed
-
-0.69135523 BTC from Aug 1 hop vault
+Block 960,668
+
+0.509799 BTC from Hop 1 · bc1qu2…6srw
 
 Watched holdings
 
 
 Evening vault
 Jul 31 consolidation, still unspent. Aug 1 pass-through tracked separately below
-	bc1q7rmsw0…lrrcgf	0.50980268 BTC
-<live-fiat-value>
-	0.50980268 BTC	1	HELD
+	bc1q7rmsw0…lrrcgf	0.00 BTC
+<live-fiat-value>
+	0.50980268 BTC	0	EMPTIED
 
 Aug 1 hop vault
 0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. An Ocean miner payout also landed here and was spent onward — not part of this report balance
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 
+HOP 1
+61c0ddac…98c095
+−0.509799 BTC
+From Hop 1 · bc1qu2…6srw bc1qu2uq…6srw
+Block 960,668
+
+To bc1qt8ca…5y4k, bc1qzkap…6e4z
+
+HOP 2
+49dd2935…d49564
+−0.24 BTC
+From Hop 2 · bc1qzk…6e4z bc1qzkap…6e4z
+Block 960,668
+
+To bc1qprkj…jr98
+
+ff327937…abc133
+−0.50980268 BTC
+From Evening vault bc1q7rms…rcgf
+Block 960,666
+
+To bc1qu2uq…6srw
+
+HOP 2
+3cf126ca…10ae88
+−0.44999667 BTC
+From Hop 2 · 3P3K2M…Lfgy 3P3K2MQw…Lfgy
+Block 960,666
+
+To 3KMmeqPe…qtc8
+
+HOP 1
+a7bf30f0…92fdec
+−0.45 BTC
+From Hop 1 · bc1qsd…jah8 bc1qsd9t…jah8
+Block 960,663
+
+To 3P3K2MQw…Lfgy
+
+HOP 2
+d0bcdc4a…33c0a0
+−0.24134867 BTC
+From Hop 2 · 36c8ap…QW35 36c8aprK…QW35
+Block 960,661
+
+To 3KMmeqPe…qtc8
+
 5ecc3052…a8bf87
 −0.69135523 BTC
 From Aug 1 hop vault bc1qayw8…2u0s
-Unconfirmed
+Block 960,658
 
 To bc1qsd9t…jah8, bc1qvrpc…cddc
 
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
-Unconfirmed
+From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
+Block 960,658
 
 To 36c8aprK…QW35
 
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 10:36). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 11:47). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,847,611

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,702,804
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,832,961
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,214,494
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  96. source content difference between and source content +5 -12

    The movement feed dropped the earlier confirmed 0.06042459 BTC entry and showed the unconfirmed 0.69135523 BTC spend from the Aug 1 hop vault as the last movement.

    seen · Captured here 14,491 chars
    What changed from the previous capture 17 lines 
     
 LAST MOVEMENT
 
-Aug 1, 2026, 07:19 PM UTC
-
-0.06042459 BTC from Aug 1 hop vault
+Unconfirmed
+
+0.69135523 BTC from Aug 1 hop vault
 
 Watched holdings
 
 HOP 1
 135d4c2c…2d4ce9
 −0.241352 BTC
-From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
+From Hop 1 from Aug 1 hop vault bc1qvrpc…cddc
 Unconfirmed
 
 To 36c8aprK…QW35
-
-24f4b236…4e5187
-−0.06042459 BTC
-From Aug 1 hop vault bc1qayw8…2u0s
-Aug 1, 2026, 07:19 PM UTC
-
-To bc1qlryk…9edm
 
 Am I at risk?
 
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 10:31). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 10:36). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,742,230

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,619,440
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,827,097
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,198,459
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  97. source content difference between and source content +42 -754

    The tracker narrowed its Wave 3 watch from 221 vaults to 75 higher-value matches of at least 0.5 BTC (about 181.29 BTC), and recorded the first outbound movement: the Aug 1 hop vault showed EMPTIED with 0.69135523 BTC moved and the movement feed listed its first transactions.

    seen · Captured here 14,610 chars
    What changed from the previous capture 796 lines 
     
 STILL HELD
 
-100%
-
-of 1,361.64515804 BTC consolidated
+99.95%
+
+of 1,341.47626197 BTC consolidated
 
 BALANCE ON WATCH
 
-1,361.64515804 BTC
+1,340.78490674 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 MOVED
 
-0.00 BTC
-
-Reported consolidation still on the holding addresses
+0.69135523 BTC
+
+Reported consolidation has left the holding addresses
 
 LAST MOVEMENT
 
-Unmoved
-
-No spends of the reported consolidation
+Aug 1, 2026, 07:19 PM UTC
+
+0.06042459 BTC from Aug 1 hop vault
 
 Watched holdings
 
-About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,361.64515804 BTC is in watched holdings (core vaults live-polled; 221 Wave 3 vaults from the cron snapshot). The remaining ~6.9389531 BTC is mostly unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
+About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,341.47626197 BTC is in watched holdings (core vaults live-polled; 75 higher-value Wave 3 vaults ≥ 0.50 BTC from the cron snapshot). The remaining ~27.10784917 BTC is mostly smaller/unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 	bc1qmd5m5k…9n8jp6	30.18476329 BTC
 <live-fiat-value>
 	30.18476329 BTC	93	HELD
-GALAXY WAVE 3 · JUL 31–AUG 1 · 221 vaults
+GALAXY WAVE 3 · JUL 31–AUG 1 · 75 vaults
 Source
 
-Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 221 fingerprint-matched P2WSH vaults (~201.45 BTC) — see attribution below.
+Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 75 higher-value fingerprint matches (≥ 0.5 BTC each, ~181.29 BTC) — see attribution below.
 
 WHY THESE LOOK LIKE STOLEN WAVE 3 FUNDS
 
-Not Galaxy’s published address list. Matched their Wave 3 fingerprint: blocks 960396–960471, ~180–220 sat/vB no-change sweeps into fresh parks, then hops to still-funded native P2WSH vaults. Balances come from a server snapshot (cron), not live browser polls. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
+Not Galaxy’s published address list. Matched their Wave 3 fingerprint (blocks 960396–960471, ~180–220 sat/vB, fresh park → P2WSH vault), then kept only higher-value vaults (≥ 0.5 BTC) so the cron snapshot stays reliable on public explorers. Smaller matched vaults are omitted on purpose. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
 
 WATCHED
-221 P2WSH vaults · 201.45487804 BTC
-snapshot · Galaxy ~293 / ~207.73 BTC
+75 P2WSH vaults · 181.28598197 BTC
+≥ 0.50 BTC each · snapshot · Galaxy ~293 / ~207.73 BTC
 BLOCKS
 960,396–960,471
 FEE WINDOW
 Wave 3 vault 57
 	bc1qnjpfhc…a8tqc5	0.77812263 BTC
 <live-fiat-value>
-	0.77812263 BTC	0	HELD
+	0.77812263 BTC	1	HELD
 
 Wave 3 vault 58
 	bc1q64nmnz…su2td0	0.77291101 BTC
 	bc1qkyncy6…sw293h	0.50163823 BTC
 <live-fiat-value>
 	0.50163823 BTC	1	HELD
-
-Wave 3 vault 76
-	bc1qpthn8e…qkg3ud	0.4992642 BTC
-<live-fiat-value>
-	0.4992642 BTC	1	HELD
-
-Wave 3 vault 77
-	bc1qnfva34…xukm5w	0.48945961 BTC
-<live-fiat-value>
-	0.48945961 BTC	1	HELD
-
-Wave 3 vault 78
-	bc1qaktzwv…yg8zmd	0.48493299 BTC
-<live-fiat-value>
-	0.48493299 BTC	1	HELD
-
-Wave 3 vault 79
-	bc1q0p97ht…hy2r2h	0.45768821 BTC
-<live-fiat-value>
-	0.45768821 BTC	1	HELD
-
-Wave 3 vault 80
-	bc1qpncfuu…fxdzff	0.45593126 BTC
-<live-fiat-value>
-	0.45593126 BTC	1	HELD
-
-Wave 3 vault 81
-	bc1qd4mgu2…t3w43g	0.42213138 BTC
-<live-fiat-value>
-	0.42213138 BTC	1	HELD
-
-Wave 3 vault 82
-	bc1q5095ky…zuz3fr	0.4157288 BTC
-<live-fiat-value>
-	0.4157288 BTC	1	HELD
-
-Wave 3 vault 83
-	bc1qpq3rxv…c49vq7	0.4138718 BTC
-<live-fiat-value>
-	0.4138718 BTC	1	HELD
-
-Wave 3 vault 84
-	bc1qepuh86…zpd5sf	0.39997467 BTC
-<live-fiat-value>
-	0.39997467 BTC	1	HELD
-
-Wave 3 vault 85
-	bc1qzkkhct…r7py7l	0.39492486 BTC
-<live-fiat-value>
-	0.39492486 BTC	1	HELD
-
-Wave 3 vault 86
-	bc1qdh03rz…w0plyz	0.37768772 BTC
-<live-fiat-value>
-	0.37768772 BTC	1	HELD
-
-Wave 3 vault 87
-	bc1qyj735e…qejxzx	0.3773678 BTC
-<live-fiat-value>
-	0.3773678 BTC	1	HELD
-
-Wave 3 vault 88
-	bc1q8p3086…5k8jxd	0.37668657 BTC
-<live-fiat-value>
-	0.37668657 BTC	1	HELD
-
-Wave 3 vault 89
-	bc1q5vg8ct…90mpt2	0.35046599 BTC
-<live-fiat-value>
-	0.35046599 BTC	1	HELD
-
-Wave 3 vault 90
-	bc1qhtjcwj…5pnm2q	0.3457658 BTC
-<live-fiat-value>
-	0.3457658 BTC	1	HELD
-
-Wave 3 vault 91
-	bc1qsm6ag0…7v5mk7	0.34040498 BTC
-<live-fiat-value>
-	0.34040498 BTC	1	HELD
-
-Wave 3 vault 92
-	bc1qntaar8…qlksy7	0.33672299 BTC
-<live-fiat-value>
-	0.33672299 BTC	1	HELD
-
-Wave 3 vault 93
-	bc1qnjdng0…xce4t6	0.33483405 BTC
-<live-fiat-value>
-	0.33483405 BTC	1	HELD
-
-Wave 3 vault 94
-	bc1q5xed2h…zqqdmm	0.33463041 BTC
-<live-fiat-value>
-	0.33463041 BTC	1	HELD
-
-Wave 3 vault 95
-	bc1qwhj5zd…wmj8k4	0.33348987 BTC
-<live-fiat-value>
-	0.33348987 BTC	1	HELD
-
-Wave 3 vault 96
-	bc1qnxs73p…r2r84m	0.3321912 BTC
-<live-fiat-value>
-	0.3321912 BTC	1	HELD
-
-Wave 3 vault 97
-	bc1q68ryrh…d7mjd9	0.32664138 BTC
-<live-fiat-value>
-	0.32664138 BTC	1	HELD
-
-Wave 3 vault 98
-	bc1qk6tu7a…7m0xpd	0.32208629 BTC
-<live-fiat-value>
-	0.32208629 BTC	1	HELD
-
-Wave 3 vault 99
-	bc1q7syv0e…m5335p	0.31341339 BTC
-<live-fiat-value>
-	0.31341339 BTC	1	HELD
-
-Wave 3 vault 100
-	bc1q4v2hf3…20megd	0.30929503 BTC
-<live-fiat-value>
-	0.30929503 BTC	1	HELD
-
-Wave 3 vault 101
-	bc1qjka87a…qxa8z3	0.30606469 BTC
-<live-fiat-value>
-	0.30606469 BTC	1	HELD
-
-Wave 3 vault 102
-	bc1qnx8620…8s5rae	0.30575377 BTC
-<live-fiat-value>
-	0.30575377 BTC	1	HELD
-
-Wave 3 vault 103
-	bc1qad63pm…yutt2t	0.3006318 BTC
-<live-fiat-value>
-	0.3006318 BTC	1	HELD
-
-Wave 3 vault 104
-	bc1q4k3tuz…kqjw3z	0.29774544 BTC
-<live-fiat-value>
-	0.29774544 BTC	1	HELD
-
-Wave 3 vault 105
-	bc1qcyp4cj…zr3zl6	0.28525508 BTC
-<live-fiat-value>
-	0.28525508 BTC	1	HELD
-
-Wave 3 vault 106
-	bc1q520jl5…m7gynq	0.26962117 BTC
-<live-fiat-value>
-	0.26962117 BTC	1	HELD
-
-Wave 3 vault 107
-	bc1q9m306l…ely8mh	0.262589 BTC
-<live-fiat-value>
-	0.262589 BTC	1	HELD
-
-Wave 3 vault 108
-	bc1qg0ahk0…mtufs2	0.2615388 BTC
-<live-fiat-value>
-	0.2615388 BTC	1	HELD
-
-Wave 3 vault 109
-	bc1qn0alky…6tht62	0.25169499 BTC
-<live-fiat-value>
-	0.25169499 BTC	1	HELD
-
-Wave 3 vault 110
-	bc1qxg6q4y…e8dela	0.24656373 BTC
-<live-fiat-value>
-	0.24656373 BTC	1	HELD
-
-Wave 3 vault 111
-	bc1qr06wx2…ld3z7d	0.23981457 BTC
-<live-fiat-value>
-	0.23981457 BTC	1	HELD
-
-Wave 3 vault 112
-	bc1qtvlcma…93gd9x	0.2359538 BTC
-<live-fiat-value>
-	0.2359538 BTC	1	HELD
-
-Wave 3 vault 113
-	bc1qs3hmed…krxhd8	0.2357021 BTC
-<live-fiat-value>
-	0.2357021 BTC	1	HELD
-
-Wave 3 vault 114
-	bc1qj8a03j…rld23p	0.22820581 BTC
-<live-fiat-value>
-	0.22820581 BTC	1	HELD
-
-Wave 3 vault 115
-	bc1q5cem3f…6ljx35	0.22722561 BTC
-<live-fiat-value>
-	0.22722561 BTC	1	HELD
-
-Wave 3 vault 116
-	bc1qum0q57…nsdz95	0.21931343 BTC
-<live-fiat-value>
-	0.21931343 BTC	1	HELD
-
-Wave 3 vault 117
-	bc1qlek7vw…ms6z7m	0.21789169 BTC
-<live-fiat-value>
-	0.21789169 BTC	1	HELD
-
-Wave 3 vault 118
-	bc1q4re4r9…r0a4ny	0.21300193 BTC
-<live-fiat-value>
-	0.21300193 BTC	1	HELD
-
-Wave 3 vault 119
-	bc1q0m7cpt…h9kly6	0.21004234 BTC
-<live-fiat-value>
-	0.21004234 BTC	1	HELD
-
-Wave 3 vault 120
-	bc1qygry8h…xgr35z	0.20250125 BTC
-<live-fiat-value>
-	0.20250125 BTC	1	HELD
-
-Wave 3 vault 121
-	bc1qdqhy59…9dxlwu	0.20052544 BTC
-<live-fiat-value>
-	0.20052544 BTC	1	HELD
-
-Wave 3 vault 122
-	bc1qty4ev9…pkm3dg	0.19971171 BTC
-<live-fiat-value>
-	0.19971171 BTC	1	HELD
-
-Wave 3 vault 123
-	bc1q4e4j2s…hm7z6l	0.19939541 BTC
-<live-fiat-value>
-	0.19939541 BTC	0	HELD
-
-Wave 3 vault 124
-	bc1qtxanjh…ye9h75	0.19547911 BTC
-<live-fiat-value>
-	0.19547911 BTC	0	HELD
-
-Wave 3 vault 125
-	bc1q2my4da…9dwjhf	0.19343429 BTC
-<live-fiat-value>
-	0.19343429 BTC	1	HELD
-
-Wave 3 vault 126
-	bc1qxueed4…y4m72x	0.1928358 BTC
-<live-fiat-value>
-	0.1928358 BTC	1	HELD
-
-Wave 3 vault 127
-	bc1q2k0lx9…nngx96	0.17831005 BTC
-<live-fiat-value>
-	0.17831005 BTC	1	HELD
-
-Wave 3 vault 128
-	bc1ql4h3x0…2talu9	0.17092148 BTC
-<live-fiat-value>
-	0.17092148 BTC	1	HELD
-
-Wave 3 vault 129
-	bc1qm099l8…d32mhe	0.1696318 BTC
-<live-fiat-value>
-	0.1696318 BTC	1	HELD
-
-Wave 3 vault 130
-	bc1qkzphty…d23t87	0.16825952 BTC
-<live-fiat-value>
-	0.16825952 BTC	0	HELD
-
-Wave 3 vault 131
-	bc1q47gull…kp3vsx	0.15207015 BTC
-<live-fiat-value>
-	0.15207015 BTC	1	HELD
-
-Wave 3 vault 132
-	bc1q5sx3fz…xfeuqh	0.13137773 BTC
-<live-fiat-value>
-	0.13137773 BTC	1	HELD
-
-Wave 3 vault 133
-	bc1qx7udtl…r04p23	0.12416239 BTC
-<live-fiat-value>
-	0.12416239 BTC	1	HELD
-
-Wave 3 vault 134
-	bc1q55hfcx…7u6tsm	0.11674686 BTC
-<live-fiat-value>
-	0.11674686 BTC	1	HELD
-
-Wave 3 vault 135
-	bc1qspqd0r…rdggr9	0.11580619 BTC
-<live-fiat-value>
-	0.11580619 BTC	0	HELD
-
-Wave 3 vault 136
-	bc1q88uyey…zfl4xq	0.11106556 BTC
-<live-fiat-value>
-	0.11106556 BTC	1	HELD
-
-Wave 3 vault 137
-	bc1qpy9clc…qux242	0.10483982 BTC
-<live-fiat-value>
-	0.10483982 BTC	0	HELD
-
-Wave 3 vault 138
-	bc1qsc0yxk…9k7pe7	0.10451152 BTC
-<live-fiat-value>
-	0.10451152 BTC	1	HELD
-
-Wave 3 vault 139
-	bc1q0mve58…fr9lr9	0.09982394 BTC
-<live-fiat-value>
-	0.09982394 BTC	1	HELD
-
-Wave 3 vault 140
-	bc1q52q0hm…kuptws	0.0992242 BTC
-<live-fiat-value>
-	0.0992242 BTC	1	HELD
-
-Wave 3 vault 141
-	bc1q5fqtyq…h4xv36	0.0963818 BTC
-<live-fiat-value>
-	0.0963818 BTC	1	HELD
-
-Wave 3 vault 142
-	bc1qm8erpw…wdl459	0.09471637 BTC
-<live-fiat-value>
-	0.09471637 BTC	1	HELD
-
-Wave 3 vault 143
-	bc1q9r029z…chmats	0.09213673 BTC
-<live-fiat-value>
-	0.09213673 BTC	1	HELD
-
-Wave 3 vault 144
-	bc1qz7a6hx…70jhhs	0.09150778 BTC
-<live-fiat-value>
-	0.09150778 BTC	0	HELD
-
-Wave 3 vault 145
-	bc1qqeayag…cufvpc	0.08654776 BTC
-<live-fiat-value>
-	0.08654776 BTC	1	HELD
-
-Wave 3 vault 146
-	bc1qngrjuy…f23m9d	0.08345491 BTC
-<live-fiat-value>
-	0.08345491 BTC	1	HELD
-
-Wave 3 vault 147
-	bc1qxa5qk5…9ppchc	0.07887331 BTC
-<live-fiat-value>
-	0.07887331 BTC	1	HELD
-
-Wave 3 vault 148
-	bc1qm4uc7y…zyyr4y	0.07697767 BTC
-<live-fiat-value>
-	0.07697767 BTC	1	HELD
-
-Wave 3 vault 149
-	bc1qmkwsy7…0g8vr8	0.07481261 BTC
-<live-fiat-value>
-	0.07481261 BTC	1	HELD
-
-Wave 3 vault 150
-	bc1qn03pr6…058pv8	0.07341378 BTC
-<live-fiat-value>
-	0.07341378 BTC	1	HELD
-
-Wave 3 vault 151
-	bc1qac2ufe…n9wkrd	0.06749657 BTC
-<live-fiat-value>
-	0.06749657 BTC	1	HELD
-
-Wave 3 vault 152
-	bc1q6en3x6…p70rjt	0.0650774 BTC
-<live-fiat-value>
-	0.0650774 BTC	1	HELD
-
-Wave 3 vault 153
-	bc1q48f368…gtly5z	0.06505319 BTC
-<live-fiat-value>
-	0.06505319 BTC	0	HELD
-
-Wave 3 vault 154
-	bc1qqx5r8d…h9gc30	0.06276802 BTC
-<live-fiat-value>
-	0.06276802 BTC	1	HELD
-
-Wave 3 vault 155
-	bc1qrdx8m7…9ay6ex	0.05977104 BTC
-<live-fiat-value>
-	0.05977104 BTC	1	HELD
-
-Wave 3 vault 156
-	bc1q5336kh…9d7t3j	0.05759026 BTC
-<live-fiat-value>
-	0.05759026 BTC	1	HELD
-
-Wave 3 vault 157
-	bc1qknw8jf…4uzn79	0.05569251 BTC
-<live-fiat-value>
-	0.05569251 BTC	1	HELD
-
-Wave 3 vault 158
-	bc1qu8hh9n…4p5csm	0.05083943 BTC
-<live-fiat-value>
-	0.05083943 BTC	1	HELD
-
-Wave 3 vault 159
-	bc1q68dyrw…cedfl4	0.05014211 BTC
-<live-fiat-value>
-	0.05014211 BTC	0	HELD
-
-Wave 3 vault 160
-	bc1qu7cw2d…e9tnfw	0.04976264 BTC
-<live-fiat-value>
-	0.04976264 BTC	1	HELD
-
-Wave 3 vault 161
-	bc1qz8aj37…ah0cz7	0.04967989 BTC
-<live-fiat-value>
-	0.04967989 BTC	1	HELD
-
-Wave 3 vault 162
-	bc1qfqyr2v…l70fkw	0.04682682 BTC
-<live-fiat-value>
-	0.04682682 BTC	1	HELD
-
-Wave 3 vault 163
-	bc1qg9wvjf…gqmg9c	0.0467388 BTC
-<live-fiat-value>
-	0.0467388 BTC	1	HELD
-
-Wave 3 vault 164
-	bc1qs7q3l0…9nv4vd	0.04653963 BTC
-<live-fiat-value>
-	0.04653963 BTC	1	HELD
-
-Wave 3 vault 165
-	bc1q7uqzcd…x6rhxq	0.04362179 BTC
-<live-fiat-value>
-	0.04362179 BTC	1	HELD
-
-Wave 3 vault 166
-	bc1qcdd8l0…q0vffy	0.04164841 BTC
-<live-fiat-value>
-	0.04164841 BTC	1	HELD
-
-Wave 3 vault 167
-	bc1qu8glud…e7ndvz	0.04056362 BTC
-<live-fiat-value>
-	0.04056362 BTC	1	HELD
-
-Wave 3 vault 168
-	bc1qggwaas…dzetw6	0.03742162 BTC
-<live-fiat-value>
-	0.03742162 BTC	1	HELD
-
-Wave 3 vault 169
-	bc1qt9nse0…cyemln	0.0373018 BTC
-<live-fiat-value>
-	0.0373018 BTC	1	HELD
-
-Wave 3 vault 170
-	bc1qth9a2r…hpjvzn	0.03547324 BTC
-<live-fiat-value>
-	0.03547324 BTC	1	HELD
-
-Wave 3 vault 171
-	bc1qyeqla8…0v0a7y	0.03486575 BTC
-<live-fiat-value>
-	0.03486575 BTC	1	HELD
-
-Wave 3 vault 172
-	bc1qxt59el…lugyn0	0.03448213 BTC
-<live-fiat-value>
-	0.03448213 BTC	1	HELD
-
-Wave 3 vault 173
-	bc1qlqp0gq…ze92se	0.03357803 BTC
-<live-fiat-value>
-	0.03357803 BTC	0	HELD
-
-Wave 3 vault 174
-	bc1qlqzvqa…2ag66a	0.03327956 BTC
-<live-fiat-value>
-	0.03327956 BTC	0	HELD
-
-Wave 3 vault 175
-	bc1q6svg3s…6dquzl	0.0320178 BTC
-<live-fiat-value>
-	0.0320178 BTC	1	HELD
-
-Wave 3 vault 176
-	bc1q2sjk0y…u7780k	0.03159839 BTC
-<live-fiat-value>
-	0.03159839 BTC	1	HELD
-
-Wave 3 vault 177
-	bc1qssmwcg…94t6ke	0.03090333 BTC
-<live-fiat-value>
-	0.03090333 BTC	1	HELD
-
-Wave 3 vault 178
-	bc1qwc3k8g…fgygwm	0.0297678 BTC
-<live-fiat-value>
-	0.0297678 BTC	1	HELD
-
-Wave 3 vault 179
-	bc1qc9gxlt…wlr5g3	0.02517175 BTC
-<live-fiat-value>
-	0.02517175 BTC	1	HELD
-
-Wave 3 vault 180
-	bc1q04m4m8…6antvw	0.02451273 BTC
-<live-fiat-value>
-	0.02451273 BTC	1	HELD
-
-Wave 3 vault 181
-	bc1qfjdq6p…j8wx32	0.02339418 BTC
-<live-fiat-value>
-	0.02339418 BTC	1	HELD
-
-Wave 3 vault 182
-	bc1q96xgdx…vxmtn8	0.02202174 BTC
-<live-fiat-value>
-	0.02202174 BTC	1	HELD
-
-Wave 3 vault 183
-	bc1qgwhr7n…mkxj22	0.02062095 BTC
-<live-fiat-value>
-	0.02062095 BTC	1	HELD
-
-Wave 3 vault 184
-	bc1qvqg038…nact6r	0.02055783 BTC
-<live-fiat-value>
-	0.02055783 BTC	1	HELD
-
-Wave 3 vault 185
-	bc1qlz9akn…avdqeg	0.0199498 BTC
-<live-fiat-value>
-	0.0199498 BTC	1	HELD
-
-Wave 3 vault 186
-	bc1qmr2xlw…ctez3n	0.0194807 BTC
-<live-fiat-value>
-	0.0194807 BTC	1	HELD
-
-Wave 3 vault 187
-	bc1q257vjp…6rs966	0.0192128 BTC
-<live-fiat-value>
-	0.0192128 BTC	0	HELD
-
-Wave 3 vault 188
-	bc1qa42e4r…e3ywga	0.0187478 BTC
-<live-fiat-value>
-	0.0187478 BTC	1	HELD
-
-Wave 3 vault 189
-	bc1qxzgumm…w9fqms	0.01628702 BTC
-<live-fiat-value>
-	0.01628702 BTC	1	HELD
-
-Wave 3 vault 190
-	bc1qzy8fds…7qxesm	0.01586999 BTC
-<live-fiat-value>
-	0.01586999 BTC	1	HELD
-
-Wave 3 vault 191
-	bc1qgne92s…ssdzce	0.01475934 BTC
-<live-fiat-value>
-	0.01475934 BTC	0	HELD
-
-Wave 3 vault 192
-	bc1qhpvx4l…ccg0dw	0.01438078 BTC
-<live-fiat-value>
-	0.01438078 BTC	0	HELD
-
-Wave 3 vault 193
-	bc1q0xqtyc…p4knz2	0.01409784 BTC
-<live-fiat-value>
-	0.01409784 BTC	1	HELD
-
-Wave 3 vault 194
-	bc1q92egxq…szanch	0.01238588 BTC
-<live-fiat-value>
-	0.01238588 BTC	1	HELD
-
-Wave 3 vault 195
-	bc1qheu4nj…tudjeh	0.01015953 BTC
-<live-fiat-value>
-	0.01015953 BTC	1	HELD
-
-Wave 3 vault 196
-	bc1qdylevn…m7j52v	0.01015587 BTC
-<live-fiat-value>
-	0.01015587 BTC	1	HELD
-
-Wave 3 vault 197
-	bc1qgfugj7…lcvxku	0.01003015 BTC
-<live-fiat-value>
-	0.01003015 BTC	1	HELD
-
-Wave 3 vault 198
-	bc1qnzch6h…4us28y	0.00982208 BTC
-<live-fiat-value>
-	0.00982208 BTC	1	HELD
-
-Wave 3 vault 199
-	bc1qhschas…ytte5u	0.0097678 BTC
-<live-fiat-value>
-	0.0097678 BTC	1	HELD
-
-Wave 3 vault 200
-	bc1qr59506…lny6dk	0.0097678 BTC
-<live-fiat-value>
-	0.0097678 BTC	1	HELD
-
-Wave 3 vault 201
-	bc1qehrh8t…vs586j	0.0097678 BTC
-<live-fiat-value>
-	0.0097678 BTC	1	HELD
-
-Wave 3 vault 202
-	bc1q5z36el…rs68d8	0.00966129 BTC
-<live-fiat-value>
-	0.00966129 BTC	1	HELD
-
-Wave 3 vault 203
-	bc1q8plw83…munesv	0.00898723 BTC
-<live-fiat-value>
-	0.00898723 BTC	1	HELD
-
-Wave 3 vault 204
-	bc1qzs8lgh…eh5qv7	0.00863017 BTC
-<live-fiat-value>
-	0.00863017 BTC	1	HELD
-
-Wave 3 vault 205
-	bc1q0dn0dm…4new5u	0.0057678 BTC
-<live-fiat-value>
-	0.0057678 BTC	1	HELD
-
-Wave 3 vault 206
-	bc1qya0vm6…gxnztm	0.00547841 BTC
-<live-fiat-value>
-	0.00547841 BTC	3	HELD
-
-Wave 3 vault 207
-	bc1qlmvrcw…u3w0xy	0.0048457 BTC
-<live-fiat-value>
-	0.0048457 BTC	1	HELD
-
-Wave 3 vault 208
-	bc1q3ak4lx…5vflsc	0.0047678 BTC
-<live-fiat-value>
-	0.0047678 BTC	1	HELD
-
-Wave 3 vault 209
-	bc1qdq4sex…ykxqs6	0.0046617 BTC
-<live-fiat-value>
-	0.0046617 BTC	1	HELD
-
-Wave 3 vault 210
-	bc1q367ypf…w0yqyn	0.004301 BTC
-<live-fiat-value>
-	0.004301 BTC	1	HELD
-
-Wave 3 vault 211
-	bc1qxumgmr…qtzaq6	0.00426357 BTC
-<live-fiat-value>
-	0.00426357 BTC	1	HELD
-
-Wave 3 vault 212
-	bc1qu66xv8…92xy8a	0.00389163 BTC
-<live-fiat-value>
-	0.00389163 BTC	1	HELD
-
-Wave 3 vault 213
-	bc1qkrpnu4…4gksc0	0.0031878 BTC
-<live-fiat-value>
-	0.0031878 BTC	1	HELD
-
-Wave 3 vault 214
-	bc1q8e2064…h2hzlq	0.00313402 BTC
-<live-fiat-value>
-	0.00313402 BTC	1	HELD
-
-Wave 3 vault 215
-	bc1q5qyy8m…kjc86u	0.00275064 BTC
-<live-fiat-value>
-	0.00275064 BTC	1	HELD
-
-Wave 3 vault 216
-	bc1q5afm3g…mwvd03	0.00265261 BTC
-<live-fiat-value>
-	0.00265261 BTC	1	HELD
-
-Wave 3 vault 217
-	bc1qs0hglf…ahfckj	0.00260276 BTC
-<live-fiat-value>
-	0.00260276 BTC	1	HELD
-
-Wave 3 vault 218
-	bc1qelmf0v…r83870	0.0023298 BTC
-<live-fiat-value>
-	0.0023298 BTC	1	HELD
-
-Wave 3 vault 219
-	bc1qsdawrj…msj8yk	0.0022678 BTC
-<live-fiat-value>
-	0.0022678 BTC	1	HELD
-
-Wave 3 vault 220
-	bc1qp4rsut…a8ujcj	0.00226094 BTC
-<live-fiat-value>
-	0.00226094 BTC	1	HELD
-
-Wave 3 vault 221
-	bc1qqs25hv…lpvt68	0.00137172 BTC
-<live-fiat-value>
-	0.00137172 BTC	1	HELD
 EVENING WAVE · JULY 31
 Source
 
 
 Aug 1 hop vault
 0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. An Ocean miner payout also landed here and was spent onward — not part of this report balance
-	bc1qayw8nr…7w2u0s	0.69135523 BTC
-<live-fiat-value>
-	0.69135523 BTC	2	HELD
+	bc1qayw8nr…7w2u0s	0.00 BTC
+<live-fiat-value>
+	0.69135523 BTC	0	EMPTIED
 MORNING WAVE · AUG 1
 Source
 
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 
-No outbound spends
-
-Reported consolidation balances have not left the holding addresses.
+5ecc3052…a8bf87
+−0.69135523 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Unconfirmed
+
+To bc1qsd9t…jah8, bc1qvrpc…cddc
+
+HOP 1
+135d4c2c…2d4ce9
+−0.241352 BTC
+From Hop 1 · bc1qvr…cddc bc1qvrpc…cddc
+Unconfirmed
+
+To 36c8aprK…QW35
+
+24f4b236…4e5187
+−0.06042459 BTC
+From Aug 1 hop vault bc1qayw8…2u0s
+Aug 1, 2026, 07:19 PM UTC
+
+To bc1qlryk…9edm
 
 Am I at risk?
 
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 08:52). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 10:31). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$86,697,066

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,583,712
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,824,584
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,191,588
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  98. source content difference between and source content +1166 -26

    The tracker added a Wave 3 section watching 221 fingerprint-matched P2WSH vaults (about 201.45 BTC) with a new attribution rationale, raising its consolidated figure from 1,160.19028 BTC to 1,361.64515804 BTC and rewriting the footer for the live-plus-cron-snapshot model.

    seen · Captured here 26,126 chars
    What changed from the previous capture 1192 lines 
     
 Seed-entropy sweeps since July 2026
 
+Alerts
+Off
 TOTAL STOLEN
 
 1,368.58411114 BTC
 
-Across tracked clusters
+<live-fiat-value>
 
 5 waves · Jul 30 – Aug 1 UTC
 
 JUL 30
 Galaxy Wave 1 · July 30
 +1,082.65 BTC
+<live-fiat-value>
 JUL 31
 Galaxy Wave 2 · July 31
 +76.16 BTC
+<live-fiat-value>
 JUL 31
 Galaxy Wave 3 · Jul 31–Aug 1
 +208.24 BTC
+<live-fiat-value>
 JUL 31
 Evening wave · July 31
 +1.20115791 BTC
+<live-fiat-value>
 AUG 1
 Morning wave · Aug 1
 +0.33295323 BTC
-Alerts
-Off
-Click to grant browser permission
-Updated <relative-time>
-Refresh
+<live-fiat-value>
 
 STILL HELD
 
 100%
 
-of 1,160.19028 BTC consolidated
+of 1,361.64515804 BTC consolidated
 
 BALANCE ON WATCH
 
-1,160.19028 BTC
-
-USD pending
+1,361.64515804 BTC
+
+<live-fiat-value>
+<live-fiat-value>
 
 MOVED
 
 
 Watched holdings
 
-About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,160.19028 BTC sits in addresses we poll live; the remaining ~208.39383114 BTC is mostly Galaxy Wave 3’s 293 P2WSH vaults plus fees. Evening/morning waves may be different operators.
+About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,361.64515804 BTC is in watched holdings (core vaults live-polled; 221 Wave 3 vaults from the cron snapshot). The remaining ~6.9389531 BTC is mostly unmatched Wave 3 vaults plus fees. Evening/morning waves may be different operators.
 
 GALAXY WAVE 1 · JULY 30
 Source
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02021083 BTC	562.02021083 BTC	11	HELD
+	bc1qq85v2c…3fcu9r	562.02021083 BTC
+<live-fiat-value>
+	562.02021083 BTC	11	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.47575357 BTC	398.47575357 BTC	2	HELD
+	bc1qx76cae…htfhe3	398.47575357 BTC
+<live-fiat-value>
+	398.47575357 BTC	2	HELD
 
 Holding 3
-	bc1q8jy96f…kwtp3q	89.6232789 BTC	89.6232789 BTC	1	HELD
+	bc1q8jy96f…kwtp3q	89.6232789 BTC
+<live-fiat-value>
+	89.6232789 BTC	1	HELD
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.4505632 BTC	32.4505632 BTC	160	HELD
+	bc1qnk4zh9…8fecp0	32.4505632 BTC
+<live-fiat-value>
+	32.4505632 BTC	160	HELD
 GALAXY WAVE 2 · JULY 31
 Source
 
 
 Wave 2 vault
 Consolidated from 1,216 sweeps (via bc1qsjrf5ze…); still unspent
-	bc1qtfrwa4…numu75	45.90251994 BTC	45.90251994 BTC	1	HELD
+	bc1qtfrwa4…numu75	45.90251994 BTC
+<live-fiat-value>
+	45.90251994 BTC	1	HELD
 
 Wave 2 collector
 Unmoved collector from 93 sweeps at ~10 sat/vB; still unspent
-	bc1qmd5m5k…9n8jp6	30.18476329 BTC	30.18476329 BTC	93	HELD
-GALAXY WAVE 3 · JUL 31–AUG 1
+	bc1qmd5m5k…9n8jp6	30.18476329 BTC
+<live-fiat-value>
+	30.18476329 BTC	93	HELD
+GALAXY WAVE 3 · JUL 31–AUG 1 · 221 vaults
 Source
 
-Blocks 960396–960471 · 1,912 addresses · ~10 sat/vB · 293 one-to-one parks into 293 P2WSH vaults (~207.73 BTC held). No shared collector — not individually watched here.
-
-No individual addresses watched for this wave (208.24 BTC in Galaxy’s total).
-
+Blocks 960396–960471 · Galaxy: ~1,912 victims, ~200 sat/vB, 293 park→P2WSH vaults (~207.73 BTC). Watching 221 fingerprint-matched P2WSH vaults (~201.45 BTC) — see attribution below.
+
+WHY THESE LOOK LIKE STOLEN WAVE 3 FUNDS
+
+Not Galaxy’s published address list. Matched their Wave 3 fingerprint: blocks 960396–960471, ~180–220 sat/vB no-change sweeps into fresh parks, then hops to still-funded native P2WSH vaults. Balances come from a server snapshot (cron), not live browser polls. Partial versus Galaxy’s ~293 vaults / ~207.73 BTC.
+
+WATCHED
+221 P2WSH vaults · 201.45487804 BTC
+snapshot · Galaxy ~293 / ~207.73 BTC
+BLOCKS
+960,396–960,471
+FEE WINDOW
+180–220 sat/vB · no change
+Galaxy: ~200 sat/vB
+PATTERN
+park → P2WSH vault
+still funded at match time
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Wave 3 vault 1
+	bc1qn3uy9j…q595ld	20.49703196 BTC
+<live-fiat-value>
+	20.49703196 BTC	1	HELD
+
+Wave 3 vault 2
+	bc1qu5dgcw…fmaygs	15.47824995 BTC
+<live-fiat-value>
+	15.47824995 BTC	1	HELD
+
+Wave 3 vault 3
+	bc1qt7ktwf…pfsewn	12.26829462 BTC
+<live-fiat-value>
+	12.26829462 BTC	1	HELD
+
+Wave 3 vault 4
+	bc1qh0kkrn…m96ruj	9.74151747 BTC
+<live-fiat-value>
+	9.74151747 BTC	1	HELD
+
+Wave 3 vault 5
+	bc1qajca7e…d23qsa	6.88509195 BTC
+<live-fiat-value>
+	6.88509195 BTC	1	HELD
+
+Wave 3 vault 6
+	bc1qysjc4j…pkkx7h	5.39098601 BTC
+<live-fiat-value>
+	5.39098601 BTC	1	HELD
+
+Wave 3 vault 7
+	bc1qtsp50w…pf73yt	4.53878769 BTC
+<live-fiat-value>
+	4.53878769 BTC	1	HELD
+
+Wave 3 vault 8
+	bc1qmqc0vu…x4nlwt	4.14175791 BTC
+<live-fiat-value>
+	4.14175791 BTC	1	HELD
+
+Wave 3 vault 9
+	bc1qsev2de…dtwlwd	4.01383972 BTC
+<live-fiat-value>
+	4.01383972 BTC	1	HELD
+
+Wave 3 vault 10
+	bc1qunepx2…s9ap78	3.98704957 BTC
+<live-fiat-value>
+	3.98704957 BTC	1	HELD
+
+Wave 3 vault 11
+	bc1qcryst7…qr0epc	3.80969146 BTC
+<live-fiat-value>
+	3.80969146 BTC	1	HELD
+
+Wave 3 vault 12
+	bc1qfdps7y…cgzcc4	3.63032005 BTC
+<live-fiat-value>
+	3.63032005 BTC	1	HELD
+
+Wave 3 vault 13
+	bc1qvyzwwp…es4sp2	3.39235311 BTC
+<live-fiat-value>
+	3.39235311 BTC	1	HELD
+
+Wave 3 vault 14
+	bc1qg4qf5d…7kkxcf	3.31668005 BTC
+<live-fiat-value>
+	3.31668005 BTC	1	HELD
+
+Wave 3 vault 15
+	bc1qrw2njs…7acn5e	3.2672638 BTC
+<live-fiat-value>
+	3.2672638 BTC	1	HELD
+
+Wave 3 vault 16
+	bc1qhm7vwp…sxflvy	3.00585628 BTC
+<live-fiat-value>
+	3.00585628 BTC	1	HELD
+
+Wave 3 vault 17
+	bc1qunseds…0rwsnx	2.99922036 BTC
+<live-fiat-value>
+	2.99922036 BTC	1	HELD
+
+Wave 3 vault 18
+	bc1qyqjwt8…m5a848	2.92126799 BTC
+<live-fiat-value>
+	2.92126799 BTC	1	HELD
+
+Wave 3 vault 19
+	bc1qhx7w9u…gwadeu	2.8116249 BTC
+<live-fiat-value>
+	2.8116249 BTC	1	HELD
+
+Wave 3 vault 20
+	bc1qe68n9f…7226a5	2.73894035 BTC
+<live-fiat-value>
+	2.73894035 BTC	1	HELD
+
+Wave 3 vault 21
+	bc1qy76lxf…asslyf	2.72482097 BTC
+<live-fiat-value>
+	2.72482097 BTC	1	HELD
+
+Wave 3 vault 22
+	bc1q7qu3wy…0qacp4	2.6494159 BTC
+<live-fiat-value>
+	2.6494159 BTC	1	HELD
+
+Wave 3 vault 23
+	bc1qe7lwuc…vxafaj	2.52064635 BTC
+<live-fiat-value>
+	2.52064635 BTC	1	HELD
+
+Wave 3 vault 24
+	bc1qw3mqlq…wxyhph	2.50784278 BTC
+<live-fiat-value>
+	2.50784278 BTC	1	HELD
+
+Wave 3 vault 25
+	bc1q48yxfm…u4r4zn	2.20411992 BTC
+<live-fiat-value>
+	2.20411992 BTC	1	HELD
+
+Wave 3 vault 26
+	bc1qvlaxcm…9kqr94	2.08421608 BTC
+<live-fiat-value>
+	2.08421608 BTC	1	HELD
+
+Wave 3 vault 27
+	bc1qmfyggr…lq084x	2.05746782 BTC
+<live-fiat-value>
+	2.05746782 BTC	1	HELD
+
+Wave 3 vault 28
+	bc1qr4jfp7…4ylgjt	2.02848692 BTC
+<live-fiat-value>
+	2.02848692 BTC	1	HELD
+
+Wave 3 vault 29
+	bc1q4x7ydy…urffxu	1.73373065 BTC
+<live-fiat-value>
+	1.73373065 BTC	1	HELD
+
+Wave 3 vault 30
+	bc1qkz22xl…ulkacd	1.69188357 BTC
+<live-fiat-value>
+	1.69188357 BTC	1	HELD
+
+Wave 3 vault 31
+	bc1qmhhm9s…m58kkh	1.68228991 BTC
+<live-fiat-value>
+	1.68228991 BTC	1	HELD
+
+Wave 3 vault 32
+	bc1qkaqcsw…9j8lch	1.58669331 BTC
+<live-fiat-value>
+	1.58669331 BTC	1	HELD
+
+Wave 3 vault 33
+	bc1qxkpyzk…tkfqla	1.51069414 BTC
+<live-fiat-value>
+	1.51069414 BTC	1	HELD
+
+Wave 3 vault 34
+	bc1qj3jd8y…j5v27w	1.42355164 BTC
+<live-fiat-value>
+	1.42355164 BTC	1	HELD
+
+Wave 3 vault 35
+	bc1qxuva8w…uddrs5	1.2984018 BTC
+<live-fiat-value>
+	1.2984018 BTC	1	HELD
+
+Wave 3 vault 36
+	bc1q2q8epf…6h0lm2	1.24272696 BTC
+<live-fiat-value>
+	1.24272696 BTC	1	HELD
+
+Wave 3 vault 37
+	bc1qtwx5m0…jfyxru	1.14238463 BTC
+<live-fiat-value>
+	1.14238463 BTC	1	HELD
+
+Wave 3 vault 38
+	bc1qfgv6py…s4h9ae	1.10389012 BTC
+<live-fiat-value>
+	1.10389012 BTC	1	HELD
+
+Wave 3 vault 39
+	bc1qwy642m…65xj4s	1.05327357 BTC
+<live-fiat-value>
+	1.05327357 BTC	1	HELD
+
+Wave 3 vault 40
+	bc1qm5z7e2…se2vd9	1.05 BTC
+<live-fiat-value>
+	1.05 BTC	1	HELD
+
+Wave 3 vault 41
+	bc1qtu8suv…4eg09u	1.0430298 BTC
+<live-fiat-value>
+	1.0430298 BTC	1	HELD
+
+Wave 3 vault 42
+	bc1qcu3w05…etphx4	1.01976357 BTC
+<live-fiat-value>
+	1.01976357 BTC	1	HELD
+
+Wave 3 vault 43
+	bc1q3ehq9t…a5yh8j	1.01857988 BTC
+<live-fiat-value>
+	1.01857988 BTC	1	HELD
+
+Wave 3 vault 44
+	bc1qqu0sp6…ltw5ac	1.01266757 BTC
+<live-fiat-value>
+	1.01266757 BTC	1	HELD
+
+Wave 3 vault 45
+	bc1qsjltn7…zc0szd	1.0069355 BTC
+<live-fiat-value>
+	1.0069355 BTC	1	HELD
+
+Wave 3 vault 46
+	bc1qtl628t…wh9r2j	1.00093255 BTC
+<live-fiat-value>
+	1.00093255 BTC	1	HELD
+
+Wave 3 vault 47
+	bc1qa3mfkw…dzd64z	1.00040325 BTC
+<live-fiat-value>
+	1.00040325 BTC	1	HELD
+
+Wave 3 vault 48
+	bc1q5c6m8q…5mgfa2	1.0001318 BTC
+<live-fiat-value>
+	1.0001318 BTC	1	HELD
+
+Wave 3 vault 49
+	bc1qt2k74x…3kf758	0.9949898 BTC
+<live-fiat-value>
+	0.9949898 BTC	1	HELD
+
+Wave 3 vault 50
+	bc1q7fgsar…msv9fj	0.9934878 BTC
+<live-fiat-value>
+	0.9934878 BTC	1	HELD
+
+Wave 3 vault 51
+	bc1qrx4r4d…kutf0n	0.85192202 BTC
+<live-fiat-value>
+	0.85192202 BTC	1	HELD
+
+Wave 3 vault 52
+	bc1q464usw…slhtk0	0.85074447 BTC
+<live-fiat-value>
+	0.85074447 BTC	1	HELD
+
+Wave 3 vault 53
+	bc1qkl4vkx…hglgc2	0.83717676 BTC
+<live-fiat-value>
+	0.83717676 BTC	1	HELD
+
+Wave 3 vault 54
+	bc1q893u28…2p64rx	0.8353508 BTC
+<live-fiat-value>
+	0.8353508 BTC	1	HELD
+
+Wave 3 vault 55
+	bc1q75t6ku…ue6rl2	0.81458411 BTC
+<live-fiat-value>
+	0.81458411 BTC	1	HELD
+
+Wave 3 vault 56
+	bc1qc5j2jg…822mln	0.80094372 BTC
+<live-fiat-value>
+	0.80094372 BTC	1	HELD
+
+Wave 3 vault 57
+	bc1qnjpfhc…a8tqc5	0.77812263 BTC
+<live-fiat-value>
+	0.77812263 BTC	0	HELD
+
+Wave 3 vault 58
+	bc1q64nmnz…su2td0	0.77291101 BTC
+<live-fiat-value>
+	0.77291101 BTC	1	HELD
+
+Wave 3 vault 59
+	bc1qassuuk…hh93zs	0.7596758 BTC
+<live-fiat-value>
+	0.7596758 BTC	1	HELD
+
+Wave 3 vault 60
+	bc1qxhju5x…h2snjc	0.75536701 BTC
+<live-fiat-value>
+	0.75536701 BTC	1	HELD
+
+Wave 3 vault 61
+	bc1qq2y3q0…gjpzkl	0.70431447 BTC
+<live-fiat-value>
+	0.70431447 BTC	1	HELD
+
+Wave 3 vault 62
+	bc1q6vc45u…9yklv7	0.69906337 BTC
+<live-fiat-value>
+	0.69906337 BTC	1	HELD
+
+Wave 3 vault 63
+	bc1qrmp5a6…7z8w8m	0.67899409 BTC
+<live-fiat-value>
+	0.67899409 BTC	1	HELD
+
+Wave 3 vault 64
+	bc1qu673md…hz5ztq	0.66510239 BTC
+<live-fiat-value>
+	0.66510239 BTC	1	HELD
+
+Wave 3 vault 65
+	bc1qhvrd93…ptvlfn	0.64598208 BTC
+<live-fiat-value>
+	0.64598208 BTC	1	HELD
+
+Wave 3 vault 66
+	bc1q0pyh8m…3m6nkf	0.61847292 BTC
+<live-fiat-value>
+	0.61847292 BTC	1	HELD
+
+Wave 3 vault 67
+	bc1q5k77u9…lddty4	0.5941699 BTC
+<live-fiat-value>
+	0.5941699 BTC	1	HELD
+
+Wave 3 vault 68
+	bc1qmkqkq6…l4mgyu	0.58741437 BTC
+<live-fiat-value>
+	0.58741437 BTC	1	HELD
+
+Wave 3 vault 69
+	bc1qwymjp7…3u33zw	0.58633145 BTC
+<live-fiat-value>
+	0.58633145 BTC	1	HELD
+
+Wave 3 vault 70
+	bc1qm2de6c…mnq34p	0.5808048 BTC
+<live-fiat-value>
+	0.5808048 BTC	1	HELD
+
+Wave 3 vault 71
+	bc1q6vpkjw…37udc6	0.54963327 BTC
+<live-fiat-value>
+	0.54963327 BTC	1	HELD
+
+Wave 3 vault 72
+	bc1qtujm6u…wpqs6r	0.54569989 BTC
+<live-fiat-value>
+	0.54569989 BTC	1	HELD
+
+Wave 3 vault 73
+	bc1qfeg6uq…a58my8	0.54132885 BTC
+<live-fiat-value>
+	0.54132885 BTC	1	HELD
+
+Wave 3 vault 74
+	bc1qkwhtgu…t8n5zl	0.5069498 BTC
+<live-fiat-value>
+	0.5069498 BTC	1	HELD
+
+Wave 3 vault 75
+	bc1qkyncy6…sw293h	0.50163823 BTC
+<live-fiat-value>
+	0.50163823 BTC	1	HELD
+
+Wave 3 vault 76
+	bc1qpthn8e…qkg3ud	0.4992642 BTC
+<live-fiat-value>
+	0.4992642 BTC	1	HELD
+
+Wave 3 vault 77
+	bc1qnfva34…xukm5w	0.48945961 BTC
+<live-fiat-value>
+	0.48945961 BTC	1	HELD
+
+Wave 3 vault 78
+	bc1qaktzwv…yg8zmd	0.48493299 BTC
+<live-fiat-value>
+	0.48493299 BTC	1	HELD
+
+Wave 3 vault 79
+	bc1q0p97ht…hy2r2h	0.45768821 BTC
+<live-fiat-value>
+	0.45768821 BTC	1	HELD
+
+Wave 3 vault 80
+	bc1qpncfuu…fxdzff	0.45593126 BTC
+<live-fiat-value>
+	0.45593126 BTC	1	HELD
+
+Wave 3 vault 81
+	bc1qd4mgu2…t3w43g	0.42213138 BTC
+<live-fiat-value>
+	0.42213138 BTC	1	HELD
+
+Wave 3 vault 82
+	bc1q5095ky…zuz3fr	0.4157288 BTC
+<live-fiat-value>
+	0.4157288 BTC	1	HELD
+
+Wave 3 vault 83
+	bc1qpq3rxv…c49vq7	0.4138718 BTC
+<live-fiat-value>
+	0.4138718 BTC	1	HELD
+
+Wave 3 vault 84
+	bc1qepuh86…zpd5sf	0.39997467 BTC
+<live-fiat-value>
+	0.39997467 BTC	1	HELD
+
+Wave 3 vault 85
+	bc1qzkkhct…r7py7l	0.39492486 BTC
+<live-fiat-value>
+	0.39492486 BTC	1	HELD
+
+Wave 3 vault 86
+	bc1qdh03rz…w0plyz	0.37768772 BTC
+<live-fiat-value>
+	0.37768772 BTC	1	HELD
+
+Wave 3 vault 87
+	bc1qyj735e…qejxzx	0.3773678 BTC
+<live-fiat-value>
+	0.3773678 BTC	1	HELD
+
+Wave 3 vault 88
+	bc1q8p3086…5k8jxd	0.37668657 BTC
+<live-fiat-value>
+	0.37668657 BTC	1	HELD
+
+Wave 3 vault 89
+	bc1q5vg8ct…90mpt2	0.35046599 BTC
+<live-fiat-value>
+	0.35046599 BTC	1	HELD
+
+Wave 3 vault 90
+	bc1qhtjcwj…5pnm2q	0.3457658 BTC
+<live-fiat-value>
+	0.3457658 BTC	1	HELD
+
+Wave 3 vault 91
+	bc1qsm6ag0…7v5mk7	0.34040498 BTC
+<live-fiat-value>
+	0.34040498 BTC	1	HELD
+
+Wave 3 vault 92
+	bc1qntaar8…qlksy7	0.33672299 BTC
+<live-fiat-value>
+	0.33672299 BTC	1	HELD
+
+Wave 3 vault 93
+	bc1qnjdng0…xce4t6	0.33483405 BTC
+<live-fiat-value>
+	0.33483405 BTC	1	HELD
+
+Wave 3 vault 94
+	bc1q5xed2h…zqqdmm	0.33463041 BTC
+<live-fiat-value>
+	0.33463041 BTC	1	HELD
+
+Wave 3 vault 95
+	bc1qwhj5zd…wmj8k4	0.33348987 BTC
+<live-fiat-value>
+	0.33348987 BTC	1	HELD
+
+Wave 3 vault 96
+	bc1qnxs73p…r2r84m	0.3321912 BTC
+<live-fiat-value>
+	0.3321912 BTC	1	HELD
+
+Wave 3 vault 97
+	bc1q68ryrh…d7mjd9	0.32664138 BTC
+<live-fiat-value>
+	0.32664138 BTC	1	HELD
+
+Wave 3 vault 98
+	bc1qk6tu7a…7m0xpd	0.32208629 BTC
+<live-fiat-value>
+	0.32208629 BTC	1	HELD
+
+Wave 3 vault 99
+	bc1q7syv0e…m5335p	0.31341339 BTC
+<live-fiat-value>
+	0.31341339 BTC	1	HELD
+
+Wave 3 vault 100
+	bc1q4v2hf3…20megd	0.30929503 BTC
+<live-fiat-value>
+	0.30929503 BTC	1	HELD
+
+Wave 3 vault 101
+	bc1qjka87a…qxa8z3	0.30606469 BTC
+<live-fiat-value>
+	0.30606469 BTC	1	HELD
+
+Wave 3 vault 102
+	bc1qnx8620…8s5rae	0.30575377 BTC
+<live-fiat-value>
+	0.30575377 BTC	1	HELD
+
+Wave 3 vault 103
+	bc1qad63pm…yutt2t	0.3006318 BTC
+<live-fiat-value>
+	0.3006318 BTC	1	HELD
+
+Wave 3 vault 104
+	bc1q4k3tuz…kqjw3z	0.29774544 BTC
+<live-fiat-value>
+	0.29774544 BTC	1	HELD
+
+Wave 3 vault 105
+	bc1qcyp4cj…zr3zl6	0.28525508 BTC
+<live-fiat-value>
+	0.28525508 BTC	1	HELD
+
+Wave 3 vault 106
+	bc1q520jl5…m7gynq	0.26962117 BTC
+<live-fiat-value>
+	0.26962117 BTC	1	HELD
+
+Wave 3 vault 107
+	bc1q9m306l…ely8mh	0.262589 BTC
+<live-fiat-value>
+	0.262589 BTC	1	HELD
+
+Wave 3 vault 108
+	bc1qg0ahk0…mtufs2	0.2615388 BTC
+<live-fiat-value>
+	0.2615388 BTC	1	HELD
+
+Wave 3 vault 109
+	bc1qn0alky…6tht62	0.25169499 BTC
+<live-fiat-value>
+	0.25169499 BTC	1	HELD
+
+Wave 3 vault 110
+	bc1qxg6q4y…e8dela	0.24656373 BTC
+<live-fiat-value>
+	0.24656373 BTC	1	HELD
+
+Wave 3 vault 111
+	bc1qr06wx2…ld3z7d	0.23981457 BTC
+<live-fiat-value>
+	0.23981457 BTC	1	HELD
+
+Wave 3 vault 112
+	bc1qtvlcma…93gd9x	0.2359538 BTC
+<live-fiat-value>
+	0.2359538 BTC	1	HELD
+
+Wave 3 vault 113
+	bc1qs3hmed…krxhd8	0.2357021 BTC
+<live-fiat-value>
+	0.2357021 BTC	1	HELD
+
+Wave 3 vault 114
+	bc1qj8a03j…rld23p	0.22820581 BTC
+<live-fiat-value>
+	0.22820581 BTC	1	HELD
+
+Wave 3 vault 115
+	bc1q5cem3f…6ljx35	0.22722561 BTC
+<live-fiat-value>
+	0.22722561 BTC	1	HELD
+
+Wave 3 vault 116
+	bc1qum0q57…nsdz95	0.21931343 BTC
+<live-fiat-value>
+	0.21931343 BTC	1	HELD
+
+Wave 3 vault 117
+	bc1qlek7vw…ms6z7m	0.21789169 BTC
+<live-fiat-value>
+	0.21789169 BTC	1	HELD
+
+Wave 3 vault 118
+	bc1q4re4r9…r0a4ny	0.21300193 BTC
+<live-fiat-value>
+	0.21300193 BTC	1	HELD
+
+Wave 3 vault 119
+	bc1q0m7cpt…h9kly6	0.21004234 BTC
+<live-fiat-value>
+	0.21004234 BTC	1	HELD
+
+Wave 3 vault 120
+	bc1qygry8h…xgr35z	0.20250125 BTC
+<live-fiat-value>
+	0.20250125 BTC	1	HELD
+
+Wave 3 vault 121
+	bc1qdqhy59…9dxlwu	0.20052544 BTC
+<live-fiat-value>
+	0.20052544 BTC	1	HELD
+
+Wave 3 vault 122
+	bc1qty4ev9…pkm3dg	0.19971171 BTC
+<live-fiat-value>
+	0.19971171 BTC	1	HELD
+
+Wave 3 vault 123
+	bc1q4e4j2s…hm7z6l	0.19939541 BTC
+<live-fiat-value>
+	0.19939541 BTC	0	HELD
+
+Wave 3 vault 124
+	bc1qtxanjh…ye9h75	0.19547911 BTC
+<live-fiat-value>
+	0.19547911 BTC	0	HELD
+
+Wave 3 vault 125
+	bc1q2my4da…9dwjhf	0.19343429 BTC
+<live-fiat-value>
+	0.19343429 BTC	1	HELD
+
+Wave 3 vault 126
+	bc1qxueed4…y4m72x	0.1928358 BTC
+<live-fiat-value>
+	0.1928358 BTC	1	HELD
+
+Wave 3 vault 127
+	bc1q2k0lx9…nngx96	0.17831005 BTC
+<live-fiat-value>
+	0.17831005 BTC	1	HELD
+
+Wave 3 vault 128
+	bc1ql4h3x0…2talu9	0.17092148 BTC
+<live-fiat-value>
+	0.17092148 BTC	1	HELD
+
+Wave 3 vault 129
+	bc1qm099l8…d32mhe	0.1696318 BTC
+<live-fiat-value>
+	0.1696318 BTC	1	HELD
+
+Wave 3 vault 130
+	bc1qkzphty…d23t87	0.16825952 BTC
+<live-fiat-value>
+	0.16825952 BTC	0	HELD
+
+Wave 3 vault 131
+	bc1q47gull…kp3vsx	0.15207015 BTC
+<live-fiat-value>
+	0.15207015 BTC	1	HELD
+
+Wave 3 vault 132
+	bc1q5sx3fz…xfeuqh	0.13137773 BTC
+<live-fiat-value>
+	0.13137773 BTC	1	HELD
+
+Wave 3 vault 133
+	bc1qx7udtl…r04p23	0.12416239 BTC
+<live-fiat-value>
+	0.12416239 BTC	1	HELD
+
+Wave 3 vault 134
+	bc1q55hfcx…7u6tsm	0.11674686 BTC
+<live-fiat-value>
+	0.11674686 BTC	1	HELD
+
+Wave 3 vault 135
+	bc1qspqd0r…rdggr9	0.11580619 BTC
+<live-fiat-value>
+	0.11580619 BTC	0	HELD
+
+Wave 3 vault 136
+	bc1q88uyey…zfl4xq	0.11106556 BTC
+<live-fiat-value>
+	0.11106556 BTC	1	HELD
+
+Wave 3 vault 137
+	bc1qpy9clc…qux242	0.10483982 BTC
+<live-fiat-value>
+	0.10483982 BTC	0	HELD
+
+Wave 3 vault 138
+	bc1qsc0yxk…9k7pe7	0.10451152 BTC
+<live-fiat-value>
+	0.10451152 BTC	1	HELD
+
+Wave 3 vault 139
+	bc1q0mve58…fr9lr9	0.09982394 BTC
+<live-fiat-value>
+	0.09982394 BTC	1	HELD
+
+Wave 3 vault 140
+	bc1q52q0hm…kuptws	0.0992242 BTC
+<live-fiat-value>
+	0.0992242 BTC	1	HELD
+
+Wave 3 vault 141
+	bc1q5fqtyq…h4xv36	0.0963818 BTC
+<live-fiat-value>
+	0.0963818 BTC	1	HELD
+
+Wave 3 vault 142
+	bc1qm8erpw…wdl459	0.09471637 BTC
+<live-fiat-value>
+	0.09471637 BTC	1	HELD
+
+Wave 3 vault 143
+	bc1q9r029z…chmats	0.09213673 BTC
+<live-fiat-value>
+	0.09213673 BTC	1	HELD
+
+Wave 3 vault 144
+	bc1qz7a6hx…70jhhs	0.09150778 BTC
+<live-fiat-value>
+	0.09150778 BTC	0	HELD
+
+Wave 3 vault 145
+	bc1qqeayag…cufvpc	0.08654776 BTC
+<live-fiat-value>
+	0.08654776 BTC	1	HELD
+
+Wave 3 vault 146
+	bc1qngrjuy…f23m9d	0.08345491 BTC
+<live-fiat-value>
+	0.08345491 BTC	1	HELD
+
+Wave 3 vault 147
+	bc1qxa5qk5…9ppchc	0.07887331 BTC
+<live-fiat-value>
+	0.07887331 BTC	1	HELD
+
+Wave 3 vault 148
+	bc1qm4uc7y…zyyr4y	0.07697767 BTC
+<live-fiat-value>
+	0.07697767 BTC	1	HELD
+
+Wave 3 vault 149
+	bc1qmkwsy7…0g8vr8	0.07481261 BTC
+<live-fiat-value>
+	0.07481261 BTC	1	HELD
+
+Wave 3 vault 150
+	bc1qn03pr6…058pv8	0.07341378 BTC
+<live-fiat-value>
+	0.07341378 BTC	1	HELD
+
+Wave 3 vault 151
+	bc1qac2ufe…n9wkrd	0.06749657 BTC
+<live-fiat-value>
+	0.06749657 BTC	1	HELD
+
+Wave 3 vault 152
+	bc1q6en3x6…p70rjt	0.0650774 BTC
+<live-fiat-value>
+	0.0650774 BTC	1	HELD
+
+Wave 3 vault 153
+	bc1q48f368…gtly5z	0.06505319 BTC
+<live-fiat-value>
+	0.06505319 BTC	0	HELD
+
+Wave 3 vault 154
+	bc1qqx5r8d…h9gc30	0.06276802 BTC
+<live-fiat-value>
+	0.06276802 BTC	1	HELD
+
+Wave 3 vault 155
+	bc1qrdx8m7…9ay6ex	0.05977104 BTC
+<live-fiat-value>
+	0.05977104 BTC	1	HELD
+
+Wave 3 vault 156
+	bc1q5336kh…9d7t3j	0.05759026 BTC
+<live-fiat-value>
+	0.05759026 BTC	1	HELD
+
+Wave 3 vault 157
+	bc1qknw8jf…4uzn79	0.05569251 BTC
+<live-fiat-value>
+	0.05569251 BTC	1	HELD
+
+Wave 3 vault 158
+	bc1qu8hh9n…4p5csm	0.05083943 BTC
+<live-fiat-value>
+	0.05083943 BTC	1	HELD
+
+Wave 3 vault 159
+	bc1q68dyrw…cedfl4	0.05014211 BTC
+<live-fiat-value>
+	0.05014211 BTC	0	HELD
+
+Wave 3 vault 160
+	bc1qu7cw2d…e9tnfw	0.04976264 BTC
+<live-fiat-value>
+	0.04976264 BTC	1	HELD
+
+Wave 3 vault 161
+	bc1qz8aj37…ah0cz7	0.04967989 BTC
+<live-fiat-value>
+	0.04967989 BTC	1	HELD
+
+Wave 3 vault 162
+	bc1qfqyr2v…l70fkw	0.04682682 BTC
+<live-fiat-value>
+	0.04682682 BTC	1	HELD
+
+Wave 3 vault 163
+	bc1qg9wvjf…gqmg9c	0.0467388 BTC
+<live-fiat-value>
+	0.0467388 BTC	1	HELD
+
+Wave 3 vault 164
+	bc1qs7q3l0…9nv4vd	0.04653963 BTC
+<live-fiat-value>
+	0.04653963 BTC	1	HELD
+
+Wave 3 vault 165
+	bc1q7uqzcd…x6rhxq	0.04362179 BTC
+<live-fiat-value>
+	0.04362179 BTC	1	HELD
+
+Wave 3 vault 166
+	bc1qcdd8l0…q0vffy	0.04164841 BTC
+<live-fiat-value>
+	0.04164841 BTC	1	HELD
+
+Wave 3 vault 167
+	bc1qu8glud…e7ndvz	0.04056362 BTC
+<live-fiat-value>
+	0.04056362 BTC	1	HELD
+
+Wave 3 vault 168
+	bc1qggwaas…dzetw6	0.03742162 BTC
+<live-fiat-value>
+	0.03742162 BTC	1	HELD
+
+Wave 3 vault 169
+	bc1qt9nse0…cyemln	0.0373018 BTC
+<live-fiat-value>
+	0.0373018 BTC	1	HELD
+
+Wave 3 vault 170
+	bc1qth9a2r…hpjvzn	0.03547324 BTC
+<live-fiat-value>
+	0.03547324 BTC	1	HELD
+
+Wave 3 vault 171
+	bc1qyeqla8…0v0a7y	0.03486575 BTC
+<live-fiat-value>
+	0.03486575 BTC	1	HELD
+
+Wave 3 vault 172
+	bc1qxt59el…lugyn0	0.03448213 BTC
+<live-fiat-value>
+	0.03448213 BTC	1	HELD
+
+Wave 3 vault 173
+	bc1qlqp0gq…ze92se	0.03357803 BTC
+<live-fiat-value>
+	0.03357803 BTC	0	HELD
+
+Wave 3 vault 174
+	bc1qlqzvqa…2ag66a	0.03327956 BTC
+<live-fiat-value>
+	0.03327956 BTC	0	HELD
+
+Wave 3 vault 175
+	bc1q6svg3s…6dquzl	0.0320178 BTC
+<live-fiat-value>
+	0.0320178 BTC	1	HELD
+
+Wave 3 vault 176
+	bc1q2sjk0y…u7780k	0.03159839 BTC
+<live-fiat-value>
+	0.03159839 BTC	1	HELD
+
+Wave 3 vault 177
+	bc1qssmwcg…94t6ke	0.03090333 BTC
+<live-fiat-value>
+	0.03090333 BTC	1	HELD
+
+Wave 3 vault 178
+	bc1qwc3k8g…fgygwm	0.0297678 BTC
+<live-fiat-value>
+	0.0297678 BTC	1	HELD
+
+Wave 3 vault 179
+	bc1qc9gxlt…wlr5g3	0.02517175 BTC
+<live-fiat-value>
+	0.02517175 BTC	1	HELD
+
+Wave 3 vault 180
+	bc1q04m4m8…6antvw	0.02451273 BTC
+<live-fiat-value>
+	0.02451273 BTC	1	HELD
+
+Wave 3 vault 181
+	bc1qfjdq6p…j8wx32	0.02339418 BTC
+<live-fiat-value>
+	0.02339418 BTC	1	HELD
+
+Wave 3 vault 182
+	bc1q96xgdx…vxmtn8	0.02202174 BTC
+<live-fiat-value>
+	0.02202174 BTC	1	HELD
+
+Wave 3 vault 183
+	bc1qgwhr7n…mkxj22	0.02062095 BTC
+<live-fiat-value>
+	0.02062095 BTC	1	HELD
+
+Wave 3 vault 184
+	bc1qvqg038…nact6r	0.02055783 BTC
+<live-fiat-value>
+	0.02055783 BTC	1	HELD
+
+Wave 3 vault 185
+	bc1qlz9akn…avdqeg	0.0199498 BTC
+<live-fiat-value>
+	0.0199498 BTC	1	HELD
+
+Wave 3 vault 186
+	bc1qmr2xlw…ctez3n	0.0194807 BTC
+<live-fiat-value>
+	0.0194807 BTC	1	HELD
+
+Wave 3 vault 187
+	bc1q257vjp…6rs966	0.0192128 BTC
+<live-fiat-value>
+	0.0192128 BTC	0	HELD
+
+Wave 3 vault 188
+	bc1qa42e4r…e3ywga	0.0187478 BTC
+<live-fiat-value>
+	0.0187478 BTC	1	HELD
+
+Wave 3 vault 189
+	bc1qxzgumm…w9fqms	0.01628702 BTC
+<live-fiat-value>
+	0.01628702 BTC	1	HELD
+
+Wave 3 vault 190
+	bc1qzy8fds…7qxesm	0.01586999 BTC
+<live-fiat-value>
+	0.01586999 BTC	1	HELD
+
+Wave 3 vault 191
+	bc1qgne92s…ssdzce	0.01475934 BTC
+<live-fiat-value>
+	0.01475934 BTC	0	HELD
+
+Wave 3 vault 192
+	bc1qhpvx4l…ccg0dw	0.01438078 BTC
+<live-fiat-value>
+	0.01438078 BTC	0	HELD
+
+Wave 3 vault 193
+	bc1q0xqtyc…p4knz2	0.01409784 BTC
+<live-fiat-value>
+	0.01409784 BTC	1	HELD
+
+Wave 3 vault 194
+	bc1q92egxq…szanch	0.01238588 BTC
+<live-fiat-value>
+	0.01238588 BTC	1	HELD
+
+Wave 3 vault 195
+	bc1qheu4nj…tudjeh	0.01015953 BTC
+<live-fiat-value>
+	0.01015953 BTC	1	HELD
+
+Wave 3 vault 196
+	bc1qdylevn…m7j52v	0.01015587 BTC
+<live-fiat-value>
+	0.01015587 BTC	1	HELD
+
+Wave 3 vault 197
+	bc1qgfugj7…lcvxku	0.01003015 BTC
+<live-fiat-value>
+	0.01003015 BTC	1	HELD
+
+Wave 3 vault 198
+	bc1qnzch6h…4us28y	0.00982208 BTC
+<live-fiat-value>
+	0.00982208 BTC	1	HELD
+
+Wave 3 vault 199
+	bc1qhschas…ytte5u	0.0097678 BTC
+<live-fiat-value>
+	0.0097678 BTC	1	HELD
+
+Wave 3 vault 200
+	bc1qr59506…lny6dk	0.0097678 BTC
+<live-fiat-value>
+	0.0097678 BTC	1	HELD
+
+Wave 3 vault 201
+	bc1qehrh8t…vs586j	0.0097678 BTC
+<live-fiat-value>
+	0.0097678 BTC	1	HELD
+
+Wave 3 vault 202
+	bc1q5z36el…rs68d8	0.00966129 BTC
+<live-fiat-value>
+	0.00966129 BTC	1	HELD
+
+Wave 3 vault 203
+	bc1q8plw83…munesv	0.00898723 BTC
+<live-fiat-value>
+	0.00898723 BTC	1	HELD
+
+Wave 3 vault 204
+	bc1qzs8lgh…eh5qv7	0.00863017 BTC
+<live-fiat-value>
+	0.00863017 BTC	1	HELD
+
+Wave 3 vault 205
+	bc1q0dn0dm…4new5u	0.0057678 BTC
+<live-fiat-value>
+	0.0057678 BTC	1	HELD
+
+Wave 3 vault 206
+	bc1qya0vm6…gxnztm	0.00547841 BTC
+<live-fiat-value>
+	0.00547841 BTC	3	HELD
+
+Wave 3 vault 207
+	bc1qlmvrcw…u3w0xy	0.0048457 BTC
+<live-fiat-value>
+	0.0048457 BTC	1	HELD
+
+Wave 3 vault 208
+	bc1q3ak4lx…5vflsc	0.0047678 BTC
+<live-fiat-value>
+	0.0047678 BTC	1	HELD
+
+Wave 3 vault 209
+	bc1qdq4sex…ykxqs6	0.0046617 BTC
+<live-fiat-value>
+	0.0046617 BTC	1	HELD
+
+Wave 3 vault 210
+	bc1q367ypf…w0yqyn	0.004301 BTC
+<live-fiat-value>
+	0.004301 BTC	1	HELD
+
+Wave 3 vault 211
+	bc1qxumgmr…qtzaq6	0.00426357 BTC
+<live-fiat-value>
+	0.00426357 BTC	1	HELD
+
+Wave 3 vault 212
+	bc1qu66xv8…92xy8a	0.00389163 BTC
+<live-fiat-value>
+	0.00389163 BTC	1	HELD
+
+Wave 3 vault 213
+	bc1qkrpnu4…4gksc0	0.0031878 BTC
+<live-fiat-value>
+	0.0031878 BTC	1	HELD
+
+Wave 3 vault 214
+	bc1q8e2064…h2hzlq	0.00313402 BTC
+<live-fiat-value>
+	0.00313402 BTC	1	HELD
+
+Wave 3 vault 215
+	bc1q5qyy8m…kjc86u	0.00275064 BTC
+<live-fiat-value>
+	0.00275064 BTC	1	HELD
+
+Wave 3 vault 216
+	bc1q5afm3g…mwvd03	0.00265261 BTC
+<live-fiat-value>
+	0.00265261 BTC	1	HELD
+
+Wave 3 vault 217
+	bc1qs0hglf…ahfckj	0.00260276 BTC
+<live-fiat-value>
+	0.00260276 BTC	1	HELD
+
+Wave 3 vault 218
+	bc1qelmf0v…r83870	0.0023298 BTC
+<live-fiat-value>
+	0.0023298 BTC	1	HELD
+
+Wave 3 vault 219
+	bc1qsdawrj…msj8yk	0.0022678 BTC
+<live-fiat-value>
+	0.0022678 BTC	1	HELD
+
+Wave 3 vault 220
+	bc1qp4rsut…a8ujcj	0.00226094 BTC
+<live-fiat-value>
+	0.00226094 BTC	1	HELD
+
+Wave 3 vault 221
+	bc1qqs25hv…lpvt68	0.00137172 BTC
+<live-fiat-value>
+	0.00137172 BTC	1	HELD
 EVENING WAVE · JULY 31
 Source
 
 
 Evening vault
 Jul 31 consolidation, still unspent. Aug 1 pass-through tracked separately below
-	bc1q7rmsw0…lrrcgf	0.50980268 BTC	0.50980268 BTC	1	HELD
+	bc1q7rmsw0…lrrcgf	0.50980268 BTC
+<live-fiat-value>
+	0.50980268 BTC	1	HELD
 
 Aug 1 hop vault
 0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. An Ocean miner payout also landed here and was spent onward — not part of this report balance
-	bc1qayw8nr…7w2u0s	0.69135523 BTC	0.69135523 BTC	2	HELD
+	bc1qayw8nr…7w2u0s	0.69135523 BTC
+<live-fiat-value>
+	0.69135523 BTC	2	HELD
 MORNING WAVE · AUG 1
 Source
 
 
 Aug 1 vault
 0.33203236 BTC from 16 victim sweeps; still unspent
-	bc1qzm5pau…v34mf3	0.33203236 BTC	0.33203236 BTC	16	HELD
+	bc1qzm5pau…v34mf3	0.33203236 BTC
+<live-fiat-value>
+	0.33203236 BTC	16	HELD
 Movement feed
 
 Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 
 July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
-Balances and transactions via mempool.bitaroo.net (fallback mirror). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
+Core vaults live via mempool.space · Wave 3 snapshot; Wave 3 from cron snapshot (2 Aug, 08:52). Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
TOTAL STOLEN

1,368.58411114 BTC

$85,895,076

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$67,949,279
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,779,954
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,069,559
JUL 31
Evening wave · July 31
+1.20115791 BTC

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  99. source content difference between and source content +56 -30

    The operator rebuilt the tracker around a five-wave model: the July 31 entry split into Galaxy Wave 2 and a new Galaxy Wave 3 spanning Jul 31 to Aug 1, the headline total moved from 1,130.09411114 to 1,368.58411114 BTC, consolidated holdings from 1,130.00551671 to 1,160.19028 BTC, and the July 30 heading was renamed from Galaxy fingerprint to Galaxy Wave 1.

    seen · Captured here 7,531 chars
    What changed from the previous capture 86 lines 
     
 TOTAL STOLEN
 
-1,130.09411114 BTC
-
-$70,933,747 at spot
-
-4 waves · Jul 30 – Aug 1 UTC
+1,368.58411114 BTC
+
+$86,007,300 at spot
+
+5 waves · Jul 30 – Aug 1 UTC
 
 0
 300
 600
 900
 1,200
+1,500
 Jul 30
 Jul 31
 Aug 1
 JUL 30
-Galaxy fingerprint · July 30
+Galaxy Wave 1 · July 30
 +1,082.65 BTC
 <live-fiat-value>
 JUL 31
-Post-scan wave · July 31
-+45.91 BTC
+Galaxy Wave 2 · July 31
++76.16 BTC
+<live-fiat-value>
+JUL 31
+Galaxy Wave 3 · Jul 31–Aug 1
++208.24 BTC
 <live-fiat-value>
 JUL 31
 Evening wave · July 31
 
 100%
 
-of 1,130.00551671 BTC consolidated
+of 1,160.19028 BTC consolidated
 
 BALANCE ON WATCH
 
-1,130.00551671 BTC
+1,160.19028 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,130.09411114 BTC drained across tracked clusters, of which 1,130.00551671 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
-
-GALAXY FINGERPRINT · JULY 30
-Source
-
-Block/Galaxy on-chain fingerprint; four consolidation holdings.
+About 1,368.58411114 BTC drained across tracked clusters. Galaxy’s same-operator total is 1,367.05 BTC across 4,585 addresses. 1,160.19028 BTC sits in addresses we poll live; the remaining ~208.39383114 BTC is mostly Galaxy Wave 3’s 293 P2WSH vaults plus fees. Evening/morning waves may be different operators.
+
+GALAXY WAVE 1 · JULY 30
+Source
+
+Blocks 960183–960191 · fixed 30 sat/vB · four consolidation holdings.
 
 SCOPE
 1,082.65 BTC · 1,196 addresses
 	bc1qnk4zh9…8fecp0	32.4505632 BTC
 <live-fiat-value>
 	32.4505632 BTC	160	HELD
-POST-SCAN WAVE · JULY 31
-Source
-
-Past Block scan end (block 960230). Seven of eight markers; RBF differs.
-
-LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
-
-July 31 vault
-Consolidated from 1,216 sweeps; still unspent
+GALAXY WAVE 2 · JULY 31
+Source
+
+Blocks 960345–960369 · 1,478 addresses · fees 50 and 10 sat/vB. ~45.90 BTC consolidated to the watched vault; ~30.18 BTC still at the unmoved collector.
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Wave 2 vault
+Consolidated from 1,216 sweeps (via bc1qsjrf5ze…); still unspent
 	bc1qtfrwa4…numu75	45.90251994 BTC
 <live-fiat-value>
 	45.90251994 BTC	1	HELD
+
+Wave 2 collector
+Unmoved collector from 93 sweeps at ~10 sat/vB; still unspent
+	bc1qmd5m5k…9n8jp6	30.18476329 BTC
+<live-fiat-value>
+	30.18476329 BTC	93	HELD
+GALAXY WAVE 3 · JUL 31–AUG 1
+Source
+
+Blocks 960396–960471 · 1,912 addresses · ~10 sat/vB · 293 one-to-one parks into 293 P2WSH vaults (~207.73 BTC held). No shared collector — not individually watched here.
+
+No individual addresses watched for this wave (208.24 BTC in Galaxy’s total).
+
 EVENING WAVE · JULY 31
 Source
 
-Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from the Kelbie vault, which also happened on July 31.
+Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from Galaxy Wave 2.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
-Galaxy Research
-
-Mapped the July 30 fingerprint set: 1,082.65 BTC across 1,196 addresses into four holdings.
+Galaxy Research · Wave 3
+
+Aug 1: third wave (~207.73 BTC into 293 P2WSH vaults). Observed total 1,367.05 BTC across 4,585 addresses.
+
+Galaxy Research · Wave 2
+
+Aug 1: second wave attributed to the same operator — 1,158.81 BTC / 2,673 addresses across seven holdings.
+
+Galaxy Research · Wave 1
+
+Mapped the July 30 fingerprint set: 1,082.65 BTC across ~1,195 addresses into four holdings.
 
 Kevin Kelbie
 
-July 31 post-scan wave (~45.9 BTC) after Block’s scan window; similar markers, different RBF behavior.
+Independently flagged the ~45.9 BTC July 31 vault (now Galaxy Wave 2) after Block’s scan window; RBF differed from Wave 1.
 
 Evan Schoenberg
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

TOTAL STOLEN

1,368.58411114 BTC

$86,007,300 at spot

5 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
1,500
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy Wave 1 · July 30
+1,082.65 BTC
$68,038,057
JUL 31
Galaxy Wave 2 · July 31
+76.16 BTC
$4,786,199
JUL 31
Galaxy Wave 3 · Jul 31–Aug 1
+208.24 BTC
$13,086,635
JUL 31
Evening wave · July 31
+1.20115791 BTC
$75,486
AUG 1

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  100. source content difference between and source content +2 -2

    The evening-wave description gained a clause noting that the Kelbie vault also occurred on 31 July; the live fiat conversion changed in the same capture.

    seen · Captured here 6,581 chars
    What changed from the previous capture 4 lines 
     
 1,130.09411114 BTC
 
-$70,685,126 at spot
+$70,847,860 at spot
 
 4 waves · Jul 30 – Aug 1 UTC
 
 EVENING WAVE · JULY 31
 Source
 
-Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from the Kelbie vault.
+Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from the Kelbie vault, which also happened on July 31.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

TOTAL STOLEN

1,130.09411114 BTC

$70,847,860 at spot

4 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy fingerprint · July 30
+1,082.65 BTC
$67,873,494
JUL 31
Post-scan wave · July 31
+45.91 BTC
$2,878,190
JUL 31
Evening wave · July 31
+1.20115791 BTC
$75,303
AUG 1
Morning wave · Aug 1
+0.33295323 BTC
$20,874
Alerts
Off

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  101. source content difference between and source content +14 -10

    The tracked total rose to 1,130.09411114 BTC after a delayed 0.19 BTC victim consolidation joined the Aug 1 hop vault. The tracker also recorded an Ocean block-960511 miner payout that touched the hop address and was peeled off, listing it as a possible lead that it does not count as stolen.

    seen · Captured here 6,549 chars
    What changed from the previous capture 24 lines 
     
 TOTAL STOLEN
 
-1,129.90257437 BTC
-
-$70,666,367 at spot
+1,130.09411114 BTC
+
+$70,542,735 at spot
 
 4 waves · Jul 30 – Aug 1 UTC
 
 <live-fiat-value>
 JUL 31
 Evening wave · July 31
-+1.00962114 BTC
++1.20115791 BTC
 <live-fiat-value>
 AUG 1
 Morning wave · Aug 1
 
 100%
 
-of 1,129.81397994 BTC consolidated
+of 1,130.00551671 BTC consolidated
 
 BALANCE ON WATCH
 
 
 Watched holdings
 
-About 1,129.90257437 BTC drained across tracked clusters, of which 1,129.81397994 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
+About 1,130.09411114 BTC drained across tracked clusters, of which 1,130.00551671 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
 
 GALAXY FINGERPRINT · JULY 30
 Source
 EVENING WAVE · JULY 31
 Source
 
-Low-fee (~1–2 sat/vB) sweeps. Jul 31: short-lived collector → 0.51 BTC vault (still held). A parallel set of sweeps consolidated separately, then on Aug 1 pushed 0.41 BTC through the same vault in ~18 min and out to a new address. Distinct from the Kelbie vault.
+Low-fee (~1–2 sat/vB) sweeps. Jul 31 vault (~0.51 BTC) still held. Aug 1: ~0.41 BTC passed through that vault to a hop address, then a delayed ~0.19 BTC victim consolidation joined the hop (now ~0.69 BTC). A separate Ocean (OCEAN.XYZ) miner-payout UTXO also touched the hop and was peeled off — possible same-operator lead, not counted as stolen. Distinct from the Kelbie vault.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 	0.50980268 BTC	1	HELD
 
 Aug 1 hop vault
-Aug 1 pass-through (0.41 BTC via the evening vault plus 0.09 BTC joined en route); separate coins from the Jul 31 vault balance
+0.4998 BTC Aug 1 pass-through + 0.1915 BTC delayed Jul 31 victim consolidation. An Ocean miner payout also landed here and was spent onward — not part of this report balance
 	bc1qayw8nr…7w2u0s	0.69135523 BTC
 <live-fiat-value>
-	0.49981846 BTC	2	HELD
+	0.69135523 BTC	2	HELD
 MORNING WAVE · AUG 1
 Source
 
 
 Evan Schoenberg
 
-Evening July 31 low-fee (~2 sat/vB) sweeps into a separate vault; tracing the Aug 1 pass-through raised the cluster to ~1.01 BTC across two live addresses.
+Evening July 31 low-fee (~2 sat/vB) sweeps into a separate vault; Aug 1 hop consolidation (incl. delayed ~0.19 BTC) raised the watched cluster to ~1.20 BTC.
+
+Ocean block 960511
+
+Coinbase of block 960511 (tag OCEAN.XYZ) paid 0.06045759 BTC to a miner address that later sent to the Aug 1 hop vault; that UTXO was peeled off and is not counted as stolen.
 
 Tomer Strolight
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

TOTAL STOLEN

1,130.09411114 BTC

$70,542,735 at spot

4 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy fingerprint · July 30
+1,082.65 BTC
$67,581,178
JUL 31
Post-scan wave · July 31
+45.91 BTC
$2,865,794
JUL 31
Evening wave · July 31
+1.20115791 BTC
$74,979
AUG 1
Morning wave · Aug 1
+0.33295323 BTC
$20,784
Alerts
Off

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  102. source content difference between and source content +37 -5

    The tracker added a 'TOTAL STOLEN' headline of 1,129.90257437 BTC with a four-wave breakdown chart, and raised the balance on watch to 1,130.00551671 BTC after a second UTXO reached the Aug 1 hop vault.

    seen · Captured here 6,190 chars
    What changed from the previous capture 42 lines 
     
 Seed-entropy sweeps since July 2026
 
+TOTAL STOLEN
+
+1,129.90257437 BTC
+
+$70,666,367 at spot
+
+4 waves · Jul 30 – Aug 1 UTC
+
+0
+300
+600
+900
+1,200
+Jul 30
+Jul 31
+Aug 1
+JUL 30
+Galaxy fingerprint · July 30
++1,082.65 BTC
+<live-fiat-value>
+JUL 31
+Post-scan wave · July 31
++45.91 BTC
+<live-fiat-value>
+JUL 31
+Evening wave · July 31
++1.00962114 BTC
+<live-fiat-value>
+AUG 1
+Morning wave · Aug 1
++0.33295323 BTC
+<live-fiat-value>
 Alerts
 Off
-Notify when holdings or followed hops spend
+Click to grant browser permission
 Updated <relative-time>
 Refresh
 
 
 BALANCE ON WATCH
 
-1,129.81397994 BTC
+1,130.00551671 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Aug 1 hop vault
 Aug 1 pass-through (0.41 BTC via the evening vault plus 0.09 BTC joined en route); separate coins from the Jul 31 vault balance
-	bc1qayw8nr…7w2u0s	0.49981846 BTC
-<live-fiat-value>
-	0.49981846 BTC	1	HELD
+	bc1qayw8nr…7w2u0s	0.69135523 BTC
+<live-fiat-value>
+	0.49981846 BTC	2	HELD
 MORNING WAVE · AUG 1
 Source
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

TOTAL STOLEN

1,129.90257437 BTC

$70,666,367 at spot

4 waves · Jul 30 – Aug 1 UTC

0
300
600
900
1,200
Jul 30
Jul 31
Aug 1
JUL 30
Galaxy fingerprint · July 30
+1,082.65 BTC
$67,711,096
JUL 31
Post-scan wave · July 31
+45.91 BTC
$2,871,303
JUL 31
Evening wave · July 31
+1.00962114 BTC
$63,144
AUG 1
Morning wave · Aug 1
+0.33295323 BTC
$20,824
Alerts
Off

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  103. source content difference between and source content +27 -11

    The tracked total rose from 1,129.31416148 to 1,129.81397994 BTC, a separate 'Aug 1 hop vault' holding was added to the evening-wave cluster, the risk checklist gained Mk3 5.0.1 to 5.0.3, a seed-origin item and revised passphrase wording, and WizardSardine and Kevin Loaec were added as sources.

    seen · Captured here 5,854 chars
    What changed from the previous capture 38 lines 
     
 100%
 
-of 1,129.31416148 BTC consolidated
+of 1,129.81397994 BTC consolidated
 
 BALANCE ON WATCH
 
-1,129.31416148 BTC
+1,129.81397994 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
+About 1,129.90257437 BTC drained across tracked clusters, of which 1,129.81397994 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
 
 GALAXY FINGERPRINT · JULY 30
 Source
 EVENING WAVE · JULY 31
 Source
 
-Block 960457. Low-fee (~2 sat/vB) sweeps into a short-lived collector, then one vault. Distinct from the Kelbie vault.
+Low-fee (~1–2 sat/vB) sweeps. Jul 31: short-lived collector → 0.51 BTC vault (still held). A parallel set of sweeps consolidated separately, then on Aug 1 pushed 0.41 BTC through the same vault in ~18 min and out to a new address. Distinct from the Kelbie vault.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-0.50980268 BTC consolidated from victim sweeps
+Jul 31 consolidation, still unspent. Aug 1 pass-through tracked separately below
 	bc1q7rmsw0…lrrcgf	0.50980268 BTC
 <live-fiat-value>
 	0.50980268 BTC	1	HELD
+
+Aug 1 hop vault
+Aug 1 pass-through (0.41 BTC via the evening vault plus 0.09 BTC joined en route); separate coins from the Jul 31 vault balance
+	bc1qayw8nr…7w2u0s	0.49981846 BTC
+<live-fiat-value>
+	0.49981846 BTC	1	HELD
 MORNING WAVE · AUG 1
 Source
 
 
 Am I at risk?
 
-Short checklist from Coinkite’s Aug 1 advisory and Block’s root-cause writeup. This tracker does not check your wallet — follow the official steps before moving funds.
+Short checklist from Coinkite’s Aug 1 advisory, Block’s root-cause writeup, and WizardSardine’s analysis. This tracker does not check your wallet — follow the official steps before moving funds.
 
 LIKELY EXPOSED
 
 Your seed is likely exposed if it was generated on vulnerable firmware. Fixed releases and later are safe for new seeds.
 
 DEVICE	VULNERABLE	FIXED
-Mk3	4.0.1–4.1.9 (~40-bit)	4.2.0+
+Mk3	4.0.1–4.1.9, 5.0.1–5.0.3 (~40-bit)	4.2.0+
 Mk4 / Mk5	Before Aug 1 patch (~72-bit)	5.6.0+
 Q	Before Aug 1 patch (~72-bit)	1.5.0Q+
 Edge (Mk4 / Mk5)	Before Aug 1 patch	6.6.0X+
 Edge (Q)	Before Aug 1 patch	6.6.0QX+
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
+ORIGIN OF THE SEED
+Exposure follows where the seed was generated, not the device holding it today. Seeds imported elsewhere, or whose origin you cannot establish, should be treated as affected.
 BEYOND THE MAIN SEED
-The same weak RNG also covered paper-wallet keys, Seed XOR masks, and some Key Teleport / clone / Secure Notes material (Block).
+Weak RNG also hit paper-wallet keys, clone / Key Teleport material, and some Secure Notes passwords — even when the BIP-39 seed itself came from dice (WizardSardine / Block).
 LOWER RISK
-At least 50 private dice rolls at seed creation, or a strong unique BIP-39 passphrase (not the device PIN). Still migrate when practical.
+At least 50 private dice rolls at seed creation. A long truly random BIP-39 passphrase (not the device PIN) may buy time, but weak passphrases are not a safe bet — still migrate when practical.
 NOT THIS BUG
-TAPSIGNER, Opendime, and Satscard use different codebases and are not affected.
+TAPSIGNER, Opendime, and Satscard use different codebases and are not affected. Mk1 and pre-4.0.1 Mk2/Mk3 firmware used the real TRNG.
 SOURCES
 Galaxy Research
 
 
 Evan Schoenberg
 
-Evening July 31 low-fee (~2 sat/vB) sweeps consolidated into a separate ~0.51 BTC vault.
+Evening July 31 low-fee (~2 sat/vB) sweeps into a separate vault; tracing the Aug 1 pass-through raised the cluster to ~1.01 BTC across two live addresses.
 
 Tomer Strolight
 
 
 Root-cause writeup on the RNG fallback, 32-bit reseed, and blast radius beyond BIP-39 seeds.
 
+WizardSardine
+
+Aug 1 deep dive: who is affected (including Mk3 5.0.x), advanced features still broken with dice seeds, and migration guidance.
+
+Kevin Loaec
+
+Announcement thread for the WizardSardine writeup.
+
 CoinDesk
 
 Aug 1 reporting on Galaxy’s expanded totals and why further waves remain possible.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.81397994 BTC consolidated

BALANCE ON WATCH

1,129.81397994 BTC

$70,473,277
$62,376/BTC

MOVED

0.00 BTC

Reported consolidation still on the holding addresses

LAST MOVEMENT

Unmoved

No spends of the reported consolidation

Watched holdings

About 1,129.90257437 BTC drained across tracked clusters, of which 1,129.81397994 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  104. source content difference between and source content +6 -17

    The tracker restated its movement feed in terms of the reported consolidation only: the earlier outbound spend and unconfirmed hop were removed from the feed, last movement returned to 'Unmoved', and a note was added that later surplus passing through a vault is ignored while the reported balance remains.

    seen · Captured here 4,799 chars
    What changed from the previous capture 23 lines 
     
 0.00 BTC
 
-Nothing has left the holding addresses
+Reported consolidation still on the holding addresses
 
 LAST MOVEMENT
 
-Aug 1, 2026, 04:33 PM UTC
+Unmoved
 
-0.4099166 BTC from Evening vault
+No spends of the reported consolidation
 
 Watched holdings
 
 	0.33203236 BTC	16	HELD
 Movement feed
 
-Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
+Outbound spends of the reported consolidation from watched holdings, then followed destinations (up to hop 2). Later surplus that passes through a vault while its reported balance remains is ignored.
 
-HOP 1
-ad2c9a4d…4a7a48
-−0.4998206 BTC
-From Hop 1 · bc1qsg…y0yw bc1qsgme…y0yw
-Unconfirmed
+No outbound spends
 
-To bc1qayw8…2u0s
-
-e4aeb758…18fce6
-−0.4099166 BTC
-From Evening vault bc1q7rms…rcgf
-Aug 1, 2026, 04:33 PM UTC
-
-To bc1qsgme…y0yw
+Reported consolidation balances have not left the holding addresses.
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.31416148 BTC consolidated

BALANCE ON WATCH

1,129.31416148 BTC

$70,824,938
$62,715/BTC

MOVED

0.00 BTC

Reported consolidation still on the holding addresses

LAST MOVEMENT

Unmoved

No spends of the reported consolidation

Watched holdings

About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  105. source content difference between and source content +8 -0

    The tracker added an unconfirmed hop-1 movement of 0.4998206 BTC onward from the followed destination of the evening vault's first outbound spend.

    seen · Captured here 4,849 chars
    What changed from the previous capture 8 lines 
     
 Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 
+HOP 1
+ad2c9a4d…4a7a48
+−0.4998206 BTC
+From Hop 1 · bc1qsg…y0yw bc1qsgme…y0yw
+Unconfirmed
+
+To bc1qayw8…2u0s
+
 e4aeb758…18fce6
 −0.4099166 BTC
 From Evening vault bc1q7rms…rcgf
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.31416148 BTC consolidated

BALANCE ON WATCH

1,129.31416148 BTC

$71,058,706
$62,922/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Aug 1, 2026, 04:33 PM UTC

0.4099166 BTC from Evening vault

Watched holdings

About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  106. source content difference between and source content +12 -11

    The tracker withdrew the Mk4 attribution for the 1 August morning wave, recording the seed as Mk3-origin, removed the 'Mk4 is in scope now' panel, and recorded the first outbound spend of 0.4099166 BTC from the evening vault at 16:33 UTC.

    seen · Captured here 4,742 chars
    What changed from the previous capture 23 lines 
     
 BALANCE ON WATCH
 
-1,129.6240794 BTC
+1,129.31416148 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 LAST MOVEMENT
 
-Unmoved
+Aug 1, 2026, 04:33 PM UTC
 
-All watched holdings still holding
+0.4099166 BTC from Evening vault
 
 Watched holdings
 
 
 Evening vault
 0.50980268 BTC consolidated from victim sweeps
-	bc1q7rmsw0…lrrcgf	0.8197206 BTC
+	bc1q7rmsw0…lrrcgf	0.50980268 BTC
 <live-fiat-value>
-	0.50980268 BTC	3	HELD
+	0.50980268 BTC	1	HELD
 MORNING WAVE · AUG 1
 Source
 
-Blocks 960518–960523. Direct victim sweeps (~15–50 sat/vB) into one vault. Includes a reported Mk4 RNG / duress-wallet honey pot (device model not visible on-chain).
+Blocks 960518–960523. Direct victim sweeps (~15–50 sat/vB) into one vault; honey-pot / duress-wallet report (Mk4 claim later withdrawn — seed was Mk3-origin).
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 
 Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 
-No outbound spends
+e4aeb758…18fce6
+−0.4099166 BTC
+From Evening vault bc1q7rms…rcgf
+Aug 1, 2026, 04:33 PM UTC
 
-All watched balances still match the post-sweep holding set.
+To bc1qsgme…y0yw
 
 Am I at risk?
 
 Q	Before Aug 1 patch (~72-bit)	1.5.0Q+
 Edge (Mk4 / Mk5)	Before Aug 1 patch	6.6.0X+
 Edge (Q)	Before Aug 1 patch	6.6.0QX+
-MK4 IS IN SCOPE NOW
-Early drains fit Mk3’s ~40-bit search space. Community reports now include Mk4 RNG seeds being swept — device model is not visible on-chain, so treat vulnerable Mk4 / Mk5 / Q seeds with the same urgency.
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
 BEYOND THE MAIN SEED
 
 Tomer Strolight
 
-Aug 1 morning wave: reported Mk4 RNG / duress-wallet honey pot swept into a ~0.33 BTC vault (blocks 960518–960523).
+Aug 1 morning wave: duress-wallet honey pot swept into a ~0.33 BTC vault; Mk4 attribution later corrected to Mk3-origin seed.
 
 Coinkite advisory
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.31416148 BTC consolidated

BALANCE ON WATCH

1,129.31416148 BTC

$71,045,154
$62,910/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Aug 1, 2026, 04:33 PM UTC

0.4099166 BTC from Evening vault

Watched holdings

About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  107. source content difference between and source content +3 -3

    The tracker's watched balance rose from 1,129.31416148 BTC to 1,129.6240794 BTC and the evening vault's displayed balance and UTXO count changed, while the reported consolidated figure for that vault stayed at 0.50980268 BTC.

    seen · Captured here 4,918 chars
    What changed from the previous capture 6 lines 
     
 BALANCE ON WATCH
 
-1,129.31416148 BTC
+1,129.6240794 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Evening vault
 0.50980268 BTC consolidated from victim sweeps
-	bc1q7rmsw0…lrrcgf	0.50980268 BTC
+	bc1q7rmsw0…lrrcgf	0.8197206 BTC
 <live-fiat-value>
-	0.50980268 BTC	1	HELD
+	0.50980268 BTC	3	HELD
 MORNING WAVE · AUG 1
 Source
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.31416148 BTC consolidated

BALANCE ON WATCH

1,129.6240794 BTC

$71,116,614
$62,956/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

Watched holdings

About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  108. source content difference between and source content +25 -8

    The tracker added an 'Aug 1 morning wave' cluster with a new vault address holding 0.33203236 BTC from 16 sweeps, described it as including a reported Mk4 RNG and duress-wallet honeypot attributed to Tomer Strolight while noting the device model is not visible on chain, added an 'Mk4 is in scope now' panel, and changed its headline to a running total.

    seen · Captured here 4,920 chars
    What changed from the previous capture 33 lines 
     
 Coldcard Hack Tracker
 
-July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters
+Seed-entropy sweeps since July 2026
 
 Alerts
 Off
 
 100%
 
-of 1,128.98210412 BTC consolidated
+of 1,129.31416148 BTC consolidated
 
 BALANCE ON WATCH
 
-1,128.98212912 BTC
+1,129.31416148 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
+About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
 
 GALAXY FINGERPRINT · JULY 30
 Source
 Block/Galaxy on-chain fingerprint; four consolidation holdings.
 
 SCOPE
-1,082.65 BTC / 1,196 addresses
-Early reports ~594.48 BTC / ~500 wallets
+1,082.65 BTC · 1,196 addresses
 WINDOW
 July 30, 2026
 01:10:20 – 01:51:26 UTC
 Holding 1
 	bc1qq85v2c…3fcu9r	562.02021083 BTC
 <live-fiat-value>
-	562.02020083 BTC	11	HELD
+	562.02021083 BTC	11	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.47575357 BTC
 <live-fiat-value>
-	398.47573857 BTC	2	HELD
+	398.47575357 BTC	2	HELD
 
 Holding 3
 	bc1q8jy96f…kwtp3q	89.6232789 BTC
 	bc1q7rmsw0…lrrcgf	0.50980268 BTC
 <live-fiat-value>
 	0.50980268 BTC	1	HELD
+MORNING WAVE · AUG 1
+Source
+
+Blocks 960518–960523. Direct victim sweeps (~15–50 sat/vB) into one vault. Includes a reported Mk4 RNG / duress-wallet honey pot (device model not visible on-chain).
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Aug 1 vault
+0.33203236 BTC from 16 victim sweeps; still unspent
+	bc1qzm5pau…v34mf3	0.33203236 BTC
+<live-fiat-value>
+	0.33203236 BTC	16	HELD
 Movement feed
 
 Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 Q	Before Aug 1 patch (~72-bit)	1.5.0Q+
 Edge (Mk4 / Mk5)	Before Aug 1 patch	6.6.0X+
 Edge (Q)	Before Aug 1 patch	6.6.0QX+
+MK4 IS IN SCOPE NOW
+Early drains fit Mk3’s ~40-bit search space. Community reports now include Mk4 RNG seeds being swept — device model is not visible on-chain, so treat vulnerable Mk4 / Mk5 / Q seeds with the same urgency.
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
 BEYOND THE MAIN SEED
 
 Evening July 31 low-fee (~2 sat/vB) sweeps consolidated into a separate ~0.51 BTC vault.
 
+Tomer Strolight
+
+Aug 1 morning wave: reported Mk4 RNG / duress-wallet honey pot swept into a ~0.33 BTC vault (blocks 960518–960523).
+
 Coinkite advisory
 
 Official guidance (updated Aug 1): who is exposed, fixed firmware versions, and migration steps.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

Seed-entropy sweeps since July 2026

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,129.31416148 BTC consolidated

BALANCE ON WATCH

1,129.31416148 BTC

$71,145,663
$62,999/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

Watched holdings

About 1,129.40281361 BTC drained across tracked clusters, of which 1,129.31416148 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  109. source content difference between and source content +11 -3

    The tracker replaced its likely-exposed paragraph with a per-model vulnerable and fixed version table covering Mk3, Mk4, Mk5, Q and both Edge tracks, and moved the evening vault's block reference from the row label into the cluster description.

    seen · Captured here 4,275 chars
    What changed from the previous capture 14 lines 
     EVENING WAVE · JULY 31
 Source
 
-Low-fee (~2 sat/vB) sweeps into a short-lived collector, then one vault. Distinct from the Kelbie vault.
+Block 960457. Low-fee (~2 sat/vB) sweeps into a short-lived collector, then one vault. Distinct from the Kelbie vault.
 
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Evening vault
-Block 960457–960458; 0.50980268 BTC consolidated from victim sweeps
+0.50980268 BTC consolidated from victim sweeps
 	bc1q7rmsw0…lrrcgf	0.50980268 BTC
 <live-fiat-value>
 	0.50980268 BTC	1	HELD
 Short checklist from Coinkite’s Aug 1 advisory and Block’s root-cause writeup. This tracker does not check your wallet — follow the official steps before moving funds.
 
 LIKELY EXPOSED
-Seed generated on Mk3 4.0.1–4.1.9 (~40-bit), or on Mk4 / Mk5 / Q before the Aug 1 fixed releases (~72-bit). Fixed: Mk3 ≥4.2.0, Mk4/Mk5 ≥5.6.0 (Edge ≥6.6.0X), Q ≥1.5.0Q (Edge ≥6.6.0QX).
+
+Your seed is likely exposed if it was generated on vulnerable firmware. Fixed releases and later are safe for new seeds.
+
+DEVICE	VULNERABLE	FIXED
+Mk3	4.0.1–4.1.9 (~40-bit)	4.2.0+
+Mk4 / Mk5	Before Aug 1 patch (~72-bit)	5.6.0+
+Q	Before Aug 1 patch (~72-bit)	1.5.0Q+
+Edge (Mk4 / Mk5)	Before Aug 1 patch	6.6.0X+
+Edge (Q)	Before Aug 1 patch	6.6.0QX+
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
 BEYOND THE MAIN SEED
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.98210412 BTC consolidated

BALANCE ON WATCH

1,128.98212912 BTC

$71,195,871
$63,062/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

Watched holdings

About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  110. source content difference between and source content +33 -15

    The tracker rewrote its reader-guidance section against the August 1 advisory and Block's writeup, added a 'beyond the main seed' item covering paper-wallet keys, Seed XOR masks and Key Teleport, clone and Secure Notes material, moved the Galaxy scope figures into the cluster card, and replaced its short source labels with descriptive per-source summaries including CoinDesk and Clay Garrett. Holding 2's UTXO count also changed from one to two.

    seen · Captured here 4,121 chars
    What changed from the previous capture 48 lines 
     Coldcard Hack Tracker
 
 July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters
-
-Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.
-
-Later waves: 45.91 BTC (Post-scan wave · July 31) · 0.50986038 BTC (Evening wave · July 31).
 
 Alerts
 Off
 
 BALANCE ON WATCH
 
-1,128.98211412 BTC
+1,128.98212912 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults. The gap is mostly miner fees. Clusters may be different operators — attribution is fingerprint / community report.
+About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.
 
 GALAXY FINGERPRINT · JULY 30
 Source
 
 Block/Galaxy on-chain fingerprint; four consolidation holdings.
 
+SCOPE
+1,082.65 BTC / 1,196 addresses
+Early reports ~594.48 BTC / ~500 wallets
 WINDOW
 July 30, 2026
 01:10:20 – 01:51:26 UTC
 	562.02020083 BTC	11	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.47573857 BTC
+	bc1qx76cae…htfhe3	398.47575357 BTC
 <live-fiat-value>
-	398.47573857 BTC	1	HELD
+	398.47573857 BTC	2	HELD
 
 Holding 3
 	bc1q8jy96f…kwtp3q	89.6232789 BTC
 
 Am I at risk?
 
-Short checklist from Coinkite’s advisory. This tracker does not check your wallet — follow the official steps before moving funds.
+Short checklist from Coinkite’s Aug 1 advisory and Block’s root-cause writeup. This tracker does not check your wallet — follow the official steps before moving funds.
 
 LIKELY EXPOSED
-Seed generated on Coldcard Mk3 firmware 4.0.1–4.1.9, or on Mk4 / Mk5 / Q before the July 2026 fixed releases.
+Seed generated on Mk3 4.0.1–4.1.9 (~40-bit), or on Mk4 / Mk5 / Q before the Aug 1 fixed releases (~72-bit). Fixed: Mk3 ≥4.2.0, Mk4/Mk5 ≥5.6.0 (Edge ≥6.6.0X), Q ≥1.5.0Q (Edge ≥6.6.0QX).
 FIRMWARE UPDATE IS NOT ENOUGH
 Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
+BEYOND THE MAIN SEED
+The same weak RNG also covered paper-wallet keys, Seed XOR masks, and some Key Teleport / clone / Secure Notes material (Block).
 LOWER RISK
 At least 50 private dice rolls at seed creation, or a strong unique BIP-39 passphrase (not the device PIN). Still migrate when practical.
 NOT THIS BUG
 TAPSIGNER, Opendime, and Satscard use different codebases and are not affected.
 SOURCES
 Galaxy Research
-On-chain sweep
+
+Mapped the July 30 fingerprint set: 1,082.65 BTC across 1,196 addresses into four holdings.
+
 Kevin Kelbie
-July 31 wave
+
+July 31 post-scan wave (~45.9 BTC) after Block’s scan window; similar markers, different RBF behavior.
+
 Evan Schoenberg
-Evening wave
+
+Evening July 31 low-fee (~2 sat/vB) sweeps consolidated into a separate ~0.51 BTC vault.
+
 Coinkite advisory
-Official guidance
+
+Official guidance (updated Aug 1): who is exposed, fixed firmware versions, and migration steps.
+
 Block Engineering
-Root-cause analysis
+
+Root-cause writeup on the RNG fallback, 32-bit reseed, and blast radius beyond BIP-39 seeds.
+
+CoinDesk
+
+Aug 1 reporting on Galaxy’s expanded totals and why further waves remain possible.
+
+Clay Garrett
+
+July 30 operator used a paid blockchain-data account during the sweeps; findings shared with authorities.
 
 Balances and transactions via mempool.space. Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.98210412 BTC consolidated

BALANCE ON WATCH

1,128.98212912 BTC

$71,185,710
$63,053/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

Watched holdings

About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults (gap is mostly fees). Clusters may be different operators — attribution is fingerprint / community report.

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  111. source content difference between and source content +29 -15

    The tracker added a third cluster, an 'Evening wave' of 31 July with its own 0.50980268 BTC vault attributed to Evan Schoenberg, restated every holding at full satoshi precision, and changed its headline from 1,128.56 BTC across two clusters to 1,129.06986038 BTC across three.

    seen · Captured here 3,418 chars
    What changed from the previous capture 44 lines 
     
 Coldcard Hack Tracker
 
-July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters
+July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters
 
 Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.
 
-Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.
+Later waves: 45.91 BTC (Post-scan wave · July 31) · 0.50986038 BTC (Evening wave · July 31).
 
 Alerts
 Off
 
 100%
 
-of 1,128.47 BTC consolidated
+of 1,128.98210412 BTC consolidated
 
 BALANCE ON WATCH
 
-1,128.47 BTC
+1,128.98211412 BTC
 
 <live-fiat-value>
 <live-fiat-value>
 
 Watched holdings
 
-About 1,128.56 BTC drained across tracked clusters, of which 1,128.47 BTC reached these vaults. The gap is mostly miner fees. Clusters may be different operators — attribution is fingerprint / community report.
+About 1,129.06986038 BTC drained across tracked clusters, of which 1,128.98210412 BTC reached these vaults. The gap is mostly miner fees. Clusters may be different operators — attribution is fingerprint / community report.
 
 GALAXY FINGERPRINT · JULY 30
 Source
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
-	bc1qq85v2c…3fcu9r	562.02 BTC
+	bc1qq85v2c…3fcu9r	562.02021083 BTC
 <live-fiat-value>
-	562.02 BTC	11	HELD
+	562.02020083 BTC	11	HELD
 
 Holding 2
-	bc1qx76cae…htfhe3	398.48 BTC
+	bc1qx76cae…htfhe3	398.47573857 BTC
 <live-fiat-value>
-	398.48 BTC	1	HELD
+	398.47573857 BTC	1	HELD
 
 Holding 3
-	bc1q8jy96f…kwtp3q	89.62 BTC
+	bc1q8jy96f…kwtp3q	89.6232789 BTC
 <live-fiat-value>
-	89.62 BTC	1	HELD
+	89.6232789 BTC	1	HELD
 
 Holding 4
 Unmoved collector remainder
-	bc1qnk4zh9…8fecp0	32.45 BTC
+	bc1qnk4zh9…8fecp0	32.4505632 BTC
 <live-fiat-value>
-	32.45 BTC	160	HELD
+	32.4505632 BTC	160	HELD
 POST-SCAN WAVE · JULY 31
 Source
 
 
 July 31 vault
 Consolidated from 1,216 sweeps; still unspent
-	bc1qtfrwa4…numu75	45.90 BTC
+	bc1qtfrwa4…numu75	45.90251994 BTC
 <live-fiat-value>
-	45.90 BTC	1	HELD
+	45.90251994 BTC	1	HELD
+EVENING WAVE · JULY 31
+Source
+
+Low-fee (~2 sat/vB) sweeps into a short-lived collector, then one vault. Distinct from the Kelbie vault.
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Evening vault
+Block 960457–960458; 0.50980268 BTC consolidated from victim sweeps
+	bc1q7rmsw0…lrrcgf	0.50980268 BTC
+<live-fiat-value>
+	0.50980268 BTC	1	HELD
 Movement feed
 
 Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 On-chain sweep
 Kevin Kelbie
 July 31 wave
+Evan Schoenberg
+Evening wave
 Coinkite advisory
 Official guidance
 Block Engineering
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,129.06986038 BTC tracked across 3 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later waves: 45.91 BTC (Post-scan wave · July 31) · 0.50986038 BTC (Evening wave · July 31).

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.98210412 BTC consolidated

BALANCE ON WATCH

1,128.98211412 BTC

$71,130,389
$63,004/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  112. source content difference between and source content +1 -1

    The monitor changed Holding 1's displayed UTXO count from ten to eleven while its BTC balance and held status remained unchanged.

    seen · Captured here 3,017 chars
    What changed from the previous capture 2 lines 
     Holding 1
 	bc1qq85v2c…3fcu9r	562.02 BTC
 <live-fiat-value>
-	562.02 BTC	10	HELD
+	562.02 BTC	11	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.48 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,145,665
$63,046/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  113. source content difference between and source content +1 -1

    The monitor changed Holding 1's displayed UTXO count from nine to ten while its BTC balance and held status remained unchanged.

    seen · Captured here 3,017 chars
    What changed from the previous capture 2 lines 
     Holding 1
 	bc1qq85v2c…3fcu9r	562.02 BTC
 <live-fiat-value>
-	562.02 BTC	9	HELD
+	562.02 BTC	10	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.48 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,100,526
$63,006/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  114. source content difference between and source content +1 -1

    The monitor changed Holding 1's displayed UTXO count from eight to nine while its BTC balance and held status remained unchanged.

    seen · Captured here 3,016 chars
    What changed from the previous capture 2 lines 
     Holding 1
 	bc1qq85v2c…3fcu9r	562.02 BTC
 <live-fiat-value>
-	562.02 BTC	8	HELD
+	562.02 BTC	9	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.48 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,114,066
$63,018/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  115. capture correction difference between and capture correction +61 -14

    The rendered capture again held the monitor's hydrated chain data after the preceding temporary loading-state capture.

    seen · Captured here 3,016 chars
    What changed from the previous capture 75 lines 
     Alerts
 Off
 Notify when holdings or followed hops spend
-Loading…
+Updated <relative-time>
 Refresh
 
 STILL HELD
 
-—
+100%
 
 of 1,128.47 BTC consolidated
 
 BALANCE ON WATCH
 
-—
+1,128.47 BTC
 
-USD pending
+<live-fiat-value>
+<live-fiat-value>
 
 MOVED
 
-—
+0.00 BTC
 
-Waiting for chain data
+Nothing has left the holding addresses
 
 LAST MOVEMENT
 
-—
+Unmoved
 
-Waiting for chain data
+All watched holdings still holding
 
 Watched holdings
 
 About 1,128.56 BTC drained across tracked clusters, of which 1,128.47 BTC reached these vaults. The gap is mostly miner fees. Clusters may be different operators — attribution is fingerprint / community report.
 
+GALAXY FINGERPRINT · JULY 30
+Source
+
+Block/Galaxy on-chain fingerprint; four consolidation holdings.
+
+WINDOW
+July 30, 2026
+01:10:20 – 01:51:26 UTC
+BLOCKS
+960,183–960,191
+FEE SIGNATURE
+30.0 sat/vB · no change
+30–75× median that week
+VICTIM PATHS
+1,183 BIP-84
+7 BIP-49 · 6 BIP-44
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
-Loading address…
-Loading address…
-Loading address…
-Loading address…
-Loading address…
+
+Holding 1
+	bc1qq85v2c…3fcu9r	562.02 BTC
+<live-fiat-value>
+	562.02 BTC	8	HELD
+
+Holding 2
+	bc1qx76cae…htfhe3	398.48 BTC
+<live-fiat-value>
+	398.48 BTC	1	HELD
+
+Holding 3
+	bc1q8jy96f…kwtp3q	89.62 BTC
+<live-fiat-value>
+	89.62 BTC	1	HELD
+
+Holding 4
+Unmoved collector remainder
+	bc1qnk4zh9…8fecp0	32.45 BTC
+<live-fiat-value>
+	32.45 BTC	160	HELD
+POST-SCAN WAVE · JULY 31
+Source
+
+Past Block scan end (block 960230). Seven of eight markers; RBF differs.
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+July 31 vault
+Consolidated from 1,216 sweeps; still unspent
+	bc1qtfrwa4…numu75	45.90 BTC
+<live-fiat-value>
+	45.90 BTC	1	HELD
 Movement feed
 
 Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 
-Scanning recent transactions…
+No outbound spends
+
+All watched balances still match the post-sweep holding set.
 
 Am I at risk?
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,134,378
$63,036/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  116. source content difference between and source content +1 -1

    The monitor changed Holding 1's displayed UTXO count from seven to eight while its BTC balance and held status remained unchanged.

    seen · Captured here 3,016 chars
    What changed from the previous capture 2 lines 
     Holding 1
 	bc1qq85v2c…3fcu9r	562.02 BTC
 <live-fiat-value>
-	562.02 BTC	7	HELD
+	562.02 BTC	8	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.48 BTC
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated <relative-time>
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,126,479
$63,029/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  117. source content difference between and source content +64 -43

    The tracker added a separately attributed 45.91 BTC post-scan cluster and changed its headline total; live fiat figures also changed in the same capture.

    seen · Captured here 3,009 chars
    What changed from the previous capture 107 lines 
     
 Coldcard Hack Tracker
 
-July 2026 seed-entropy sweep · 1,082.65 BTC drained from 1,196 addresses in 41 minutes
+July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters
 
-Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fuller fingerprint set is the 1,082.65 BTC / 1,196 figure tracked here.
+Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.
+
+Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.
+
+Alerts
+Off
+Notify when holdings or followed hops spend
+Updated just now
+Refresh
+
+STILL HELD
+
+100%
+
+of 1,128.47 BTC consolidated
+
+BALANCE ON WATCH
+
+1,128.47 BTC
+
+$71,027,168
+$62,941/BTC
+
+MOVED
+
+0.00 BTC
+
+Nothing has left the holding addresses
+
+LAST MOVEMENT
+
+Unmoved
+
+All watched holdings still holding
+
+Watched holdings
+
+About 1,128.56 BTC drained across tracked clusters, of which 1,128.47 BTC reached these vaults. The gap is mostly miner fees. Clusters may be different operators — attribution is fingerprint / community report.
+
+GALAXY FINGERPRINT · JULY 30
+Source
+
+Block/Galaxy on-chain fingerprint; four consolidation holdings.
 
 WINDOW
 July 30, 2026
 VICTIM PATHS
 1,183 BIP-84
 7 BIP-49 · 6 BIP-44
-Alerts
-Off
-Notify when holdings or followed hops spend
-Updated just now
-Refresh
-
-STILL HELD
-
-100%
-
-of 1,082.57 BTC consolidated
-
-BALANCE ON WATCH
-
-1,082.57 BTC
-
-$68,141,265
-$62,944/BTC
-
-MOVED
-
-0.00 BTC
-
-Nothing has left the holding addresses
-
-LAST MOVEMENT
-
-Unmoved
-
-All four destinations still holding
-
-Holding addresses
-
-Victims lost 1,082.65 BTC, of which 1,082.57 BTC reached these four addresses. The difference went to miners as fees during the sweep, so tracking is measured against what actually arrived here.
-
 LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
 
 Holding 1
 	bc1qq85v2c…3fcu9r	562.02 BTC
-$35,375,792
+$35,374,106
 	562.02 BTC	7	HELD
 
 Holding 2
 	bc1qx76cae…htfhe3	398.48 BTC
-$25,081,657
+$25,080,461
 	398.48 BTC	1	HELD
 
 Holding 3
 	bc1q8jy96f…kwtp3q	89.62 BTC
-$5,641,248
+$5,640,979
 	89.62 BTC	1	HELD
 
 Holding 4
 Unmoved collector remainder
 	bc1qnk4zh9…8fecp0	32.45 BTC
-$2,042,568
+$2,042,471
 	32.45 BTC	160	HELD
+POST-SCAN WAVE · JULY 31
+Source
+
+Past Block scan end (block 960230). Seven of eight markers; RBF differs.
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+July 31 vault
+Consolidated from 1,216 sweeps; still unspent
+	bc1qtfrwa4…numu75	45.90 BTC
+$2,889,151
+	45.90 BTC	1	HELD
 Movement feed
 
-Outbound spends from the four holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
+Outbound spends from watched holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
 
 No outbound spends
 
 SOURCES
 Galaxy Research
 On-chain sweep
+Kevin Kelbie
+July 31 wave
 Coinkite advisory
 Official guidance
 Block Engineering
 Root-cause analysis
 
-Balances and transactions via mempool.space. Incident facts from Galaxy Research. Not affiliated with Coinkite or Coldcard.
+Balances and transactions via mempool.space. Incident facts from Galaxy Research and community cluster reports. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweeps · 1,128.56 BTC tracked across 2 clusters

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fingerprint set is 1,082.65 BTC / 1,196 addresses. Clusters may be different operators.

Later wave: 45.91 BTC past Block’s scan end (block 960230) — Past Block scan end (block 960230). Seven of eight markers; RBF differs.

Alerts
Off
Notify when holdings or followed hops spend
Updated just now
Refresh

STILL HELD

100%

of 1,128.47 BTC consolidated

BALANCE ON WATCH

1,128.47 BTC

$71,027,168
$62,941/BTC

MOVED

0.00 BTC

Nothing has left the holding addresses

LAST MOVEMENT

Unmoved

All watched holdings still holding

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  118. capture correction difference between and capture correction +105 -0

    The browser capture obtained the rendered tracker after the initial scripted capture held an empty client-side shell.

    seen · Captured here 2,435 chars
    What changed from the previous capture 105 lines 
    +LIVE CHAIN MONITOR
+
+Coldcard Hack Tracker
+
+July 2026 seed-entropy sweep · 1,082.65 BTC drained from 1,196 addresses in 41 minutes
+
+Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fuller fingerprint set is the 1,082.65 BTC / 1,196 figure tracked here.
+
+WINDOW
+July 30, 2026
+01:10:20 – 01:51:26 UTC
+BLOCKS
+960,183–960,191
+FEE SIGNATURE
+30.0 sat/vB · no change
+30–75× median that week
+VICTIM PATHS
+1,183 BIP-84
+7 BIP-49 · 6 BIP-44
+Alerts
+Off
+Notify when holdings or followed hops spend
+Updated just now
+Refresh
+
+STILL HELD
+
+100%
+
+of 1,082.57 BTC consolidated
+
+BALANCE ON WATCH
+
+1,082.57 BTC
+
+$68,205,137
+$63,003/BTC
+
+MOVED
+
+0.00 BTC
+
+Nothing has left the holding addresses
+
+LAST MOVEMENT
+
+Unmoved
+
+All four destinations still holding
+
+Holding addresses
+
+Victims lost 1,082.65 BTC, of which 1,082.57 BTC reached these four addresses. The difference went to miners as fees during the sweep, so tracking is measured against what actually arrived here.
+
+LABEL	ADDRESS	BALANCE	REPORT	UTXOS	STATUS
+
+Holding 1
+	bc1qq85v2c…3fcu9r	562.02 BTC
+$35,408,952
+	562.02 BTC	7	HELD
+
+Holding 2
+	bc1qx76cae…htfhe3	398.48 BTC
+$25,105,167
+	398.48 BTC	1	HELD
+
+Holding 3
+	bc1q8jy96f…kwtp3q	89.62 BTC
+$5,646,535
+	89.62 BTC	1	HELD
+
+Holding 4
+Unmoved collector remainder
+	bc1qnk4zh9…8fecp0	32.45 BTC
+$2,044,483
+	32.45 BTC	160	HELD
+Movement feed
+
+Outbound spends from the four holdings, then followed destinations (up to hop 2). Empty means funds have not left consolidation.
+
+No outbound spends
+
+All watched balances still match the post-sweep holding set.
+
+Am I at risk?
+
+Short checklist from Coinkite’s advisory. This tracker does not check your wallet — follow the official steps before moving funds.
+
+LIKELY EXPOSED
+Seed generated on Coldcard Mk3 firmware 4.0.1–4.1.9, or on Mk4 / Mk5 / Q before the July 2026 fixed releases.
+FIRMWARE UPDATE IS NOT ENOUGH
+Patching does not repair an existing seed. Generate a new seed on fixed firmware and migrate funds carefully.
+LOWER RISK
+At least 50 private dice rolls at seed creation, or a strong unique BIP-39 passphrase (not the device PIN). Still migrate when practical.
+NOT THIS BUG
+TAPSIGNER, Opendime, and Satscard use different codebases and are not affected.
+SOURCES
+Galaxy Research
+On-chain sweep
+Coinkite advisory
+Official guidance
+Block Engineering
+Root-cause analysis
+
+Balances and transactions via mempool.space. Incident facts from Galaxy Research. Not affiliated with Coinkite or Coldcard.
    Extracted text as captured 
    LIVE CHAIN MONITOR

Coldcard Hack Tracker

July 2026 seed-entropy sweep · 1,082.65 BTC drained from 1,196 addresses in 41 minutes

Early reports covered ~594.48 BTC across ~500 wallets. Galaxy’s fuller fingerprint set is the 1,082.65 BTC / 1,196 figure tracked here.

WINDOW
July 30, 2026
01:10:20 – 01:51:26 UTC
BLOCKS
960,183–960,191
FEE SIGNATURE
30.0 sat/vB · no change
30–75× median that week
VICTIM PATHS
1,183 BIP-84
7 BIP-49 · 6 BIP-44
Alerts
Off
Notify when holdings or followed hops spend
Updated just now
Refresh

STILL HELD

100%

of 1,082.57 BTC consolidated

BALANCE ON WATCH

1,082.57 BTC

$68,205,137
$63,003/BTC

MOVED

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

  119. Earliest copy held
    seen · Captured here 0 chars
    Extracted text as captured
22 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
  • +8 -0 The -0.02374887 BTC Hop 1 entry that left the movement feed in the previous capture has returned, restoring the same two Hop 1 lines as before. The back-and-forth is client-rendered ordering or hydration churn, not a new on-chain event.
  • +5 -5 Only live blockchain counters moved: the watched totals and Holding 1 balance shifted by a few sats, the HELD count for an address rose from 50 to 51, and the live fiat value line changed.
  • +1 -1 Only the footer cron-snapshot timestamp advanced, from Aug 3, 04:07 AM to 05:22 AM.
  • +29 -29 Same live-counter jitter (balances up roughly 0.00001 BTC, UTXO counts up one) plus the movement-feed origin lines and footer snapshot line flip-flopping back to their previous renderings.
  • +12 -12 Only live counters and rendering state moved: watched balances drifted by sub-0.0001 BTC, the movement-feed origin lines rendered in their expanded hop-path form, and the footer snapshot line changed wording and timestamp. No claim on the page changed.
  • +1 -1 Only the footer cron snapshot timestamp advanced (Aug 3, 12:49 AM to 01:54 AM).
  • +1 -1 Only the footer cron snapshot timestamp advanced (Aug 2, 11:35 PM to Aug 3, 12:49 AM).
  • +1 -1 Only the footer cron snapshot timestamp advanced (Aug 2, 11:01 PM to 11:35 PM).
  • +1 -1 Only the footer cron snapshot timestamp advanced (Aug 2, 10:56 PM to 11:01 PM).
  • +14 -14 A partially hydrated render of the client-side page: balances reverted to pre-095953Z values, hop labels rendered as provenance chains with truncated addresses dropping out, and the footer lost its mempool.space clause; the next capture restored all of it.
  • +1 -1 Only the footer cron snapshot timestamp advanced (Aug 2, 05:32 PM to 07:11 PM).
  • +6 -6 Only live-polled counters moved: balance on watch and Holding 1 shifted by about 546 sats with the UTXO count going 11 to 12, the MOVED figure decreased (impossible for settled spends, so a mixed render), and the footer cron timestamp advanced.
  • +2 -2 The alerts indicator flipped from Off to Blocked, the notification-permission state of the capture browser, and the footer cron timestamp was reformatted (2 Aug, 15:28 to Aug 2, 03:28 PM) with the snapshot instant unchanged.
  • +1 -1 Only the footer cron snapshot clock advanced (2 Aug, 13:21 to 15:28); balances, holdings and the movement feed were unchanged.
  • +12 -36 Fiat price data failed to resolve in this capture: the header fell back to Across tracked clusters, table fiat lines collapsed to USD pending, and the footer named another rotating fallback mirror. BTC balances and holdings were unchanged.
  • +2 -2 Only the live fiat spot figure moved and the footer named a different fallback explorer mirror (mempool.emzy.de instead of mempool.space); BTC balances and movement state were unchanged.
  • +1 -1 Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.
  • +1 -1 Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.
  • +1 -1 Only the live fiat conversion changed; the BTC totals, cluster descriptions and movement state were unchanged.
  • +14 -61 The rendered capture held the monitor's temporary loading state instead of its hydrated chain data.
  • +6 -6 Only live fiat conversions changed; the BTC balances and movement state were unchanged.
  • +6 -6 Only live fiat conversions changed; the BTC balances and movement state were unchanged.
How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.