Coldcard third-wave attacker moves 45% of stolen Bitcoin
About 45% of the Bitcoin taken in the third wave of the Coldcard wallet hack has been moved, with funds routed through THORChain into Ethereum and then into CoinJoin transactions to obscure tracing, according to Galaxy Research. The exploiter started shifting funds on Sept. 2 and has moved coins from the 11 largest of 293 two-of-two multisig vaults, apparently in descending order by vault size. Those transactions also led to the discovery of a previously unknown vault that may contain another victim’s funds, though that loss is not confirmed. Across all Coldcard exploit waves, roughly 82% of the stolen Bitcoin still sits in attacker-controlled addresses, while about 18% has been moved for likely laundering. The exploit is currently the third-largest of 2026.
