All stolen funds remain dormant on the network, held across seven attacker addresses from the first two waves, while the third wave used a different pattern — one destination per victim, P2WSH outputs, and batched sweeps averaging 6.37 victims per transaction. Galaxy emphasized that Wave 3 differs on every measurable behavioral axis and should not be assumed to be the same operator, while smaller imitators are now targeting remaining vulnerable mnemonic phrases independently.
Bitcoin traded near $63,600 with 24-hour volume of $26.2 billion as of August 4, according to crypto-metrics data. The ongoing drainage of dormant coins into attacker-controlled addresses, combined with the potential for a fourth wave and copycat activity, leaves the final loss tally unresolved.
Will the fourth wave and imitator activity push confirmed losses past the $130 million threshold before vulnerable users complete migration?
Sources: Source 1 · Source 2 · Source 3 · Source 4 · Source 5 · Source 6
