An attacker linked to Coldcard thefts has moved $7.7 million in bitcoin, according to CoinDesk. The outlet reports that the movement accounts for 45% of the bitcoin stolen in a third attack wave. The available details are thin, but the reported scale is material. CoinDesk says Galaxy Research found that the attacker has now drained the 11 largest vaults tied to that third wave of Coldcard thefts. The report does not, in the provided summary, specify how the thefts occurred, when the third wave began, how many total vaults were affected, or whether any funds have been recovered. It also does not identify the attacker. For now, the supported takeaway is narrow: funds connected to a reported Coldcard theft wave have moved, and the largest vaults in that wave have reportedly been drained. Who benefits: Too early to tell from the provided source material. Who's exposed: The provided source material identifies the 11 largest vaults tied to the third wave of Coldcard thefts as drained. It does not establish whether the risk applies more broadly.