The attacker built 293 separate vaults for the stolen Bitcoin and is emptying them in order of size, largest first.

As of mid-August, Galaxy said it had identified roughly 1,779 BTC stolen from 190 victims and more than 8,600 addresses.

The attacker has now drained the 11 largest vaults tied to the third wave of Coldcard thefts, Galaxy Research said.