Update (1030ET): A third wave of thefts against Bitcoin wallets built on flawed Coldcard firmware ran through Saturday morning, lifting observed losses to roughly 1,367 BTC - close to $89 million - drained from 4,585 addresses since Thursday. Median losses tell the same story more bluntly: 0.270 BTC in wave one, 0.010 in wave two, 0.013 in wave three. Even the fee constant changed — 30 sat/vB in wave one, 50 and 10 in wave two, roughly 200 then exactly 10 in wave three. Early reporting pegged losses at roughly 594 BTC, or about $38 million, drained from around 500 wallets. The stolen Bitcoin was consolidated within minutes into a handful of addresses and, per Galaxy, has not moved since.