A Coldcard Wave 3 operator moved about 20.5 BTC into Ether through THORChain, the first spend from the original addresses across three attack waves.
TRM Labs traced roughly 1,816 Bitcoin, worth about $116 million at its August 5 snapshot, from more than 5,200 addresses in four Coldcard-related attack waves.
Galaxy Research's August 4 update put confirmed Coldcard-related thefts at 1,596 BTC from about 7,300 addresses, while a separate suspected fourth wave could lift the estimate further.
Coldcard says a seed-generation flaw affects legacy and current hardware-wallet models; firmware updates do not repair seeds created before the fix.