Hackers drain 1,596 bitcoin from Coldcard wallets in ongoing attack
Galaxy Research first corroborated the opening wave, flagged by engineers at Block Inc., using victim reports.
On July 30 it watched hackers empty more than 1,000 bitcoin, about $99m, from more than 1,000 addresses in 41 minutes.
By Monday the firm counted three confirmed waves plus 14 smaller incidents, and flagged a suspected fourth that, if verified, would lift the total to 2,055 bitcoin, or about US$130m.
Galaxy cautioned that its tally rests on blockchain analysis and that it has not confirmed every affected wallet used the compromised software.
Roughly 90 percent of the stolen coins remain unmoved, Galaxy Research said, and it has passed attacker and victim addresses to US federal law enforcement, exchanges and cyber-investigation groups.
