What happened

Galaxy Research’s Alex Thorn flagged what he described as a suspected fourth attack wave tied to the Coldcard exploit, involving about 448 BTC. The upstream record places observed losses at roughly $88–89 million across thousands of addresses, and says affected coins have reportedly been moving back to exchanges.

The record also attributes a security assessment to Kraken’s security chief: a bug said to have existed for five years slipped through audits because they did not verify that the random-number generator was actually called. That claim points attention toward the scope and quality of the prior review process, not only the current sweeps.

Why it matters

The forced movements are being described as the largest since FTX and may be obscuring normal interpretations of Bitcoin activity. The related record notes a negative Coinbase premium and an inconclusive leveraged-short reset, leaving no clean signal for interpreting market conditions while the reported sweeps continue.

For users and observers, the practical question is whether additional affected funds emerge and whether exchange-bound flows persist. The next useful receipt would be a clearer accounting of the suspected fourth wave, including confirmed affected addresses, fund movements, and a technical explanation of the random-number-generator issue.

What to watch

Watch for confirmed attribution of the reported 448 BTC, further exchange-bound movements, and a detailed technical account of the alleged audit gap.

Sources and limits

Upstream references and independent checks

Digest dated 2026-08-03 · upstream model claude-sonnet-4-6. Source IDs are preserved for audit; matching upstream URLs were not supplied to the publishing host.

  1. 1
    ced8279809010b0d9906e73c35e07c9326c9418eUpstream reference; direct URL unavailable.
  2. 2
    61ebdbf79d8d6f358953c877f269f439815144bdUpstream reference; direct URL unavailable.
  3. 3
    bb489d46a4db692c76ec076514fe350d664bf8b0Upstream reference; direct URL unavailable.
  4. 4
    4359cffbfe1d058d45d738df893bd24012dcf508Upstream reference; direct URL unavailable.
  5. 5
    9ed8361135ee596aebf33e95077f951d1b72a11bUpstream reference; direct URL unavailable.
Continue reading
  1. 1

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: This brief relies only on the supplied upstream digest, which characterizes the fourth wave as suspected and reports rather than independently verifies the losses, flows, and audit findings.