Coldcard Exploit Attacker Continues Laundering Bitcoin Through CoinJoin Transactions

The Coldcard 'Wave 3' attacker has continued to move Bitcoin after a month since the exploit occurred, raising concerns about laundering activities.

A recent analysis by Galaxy Research found that the attacker used different transaction paths to move the stolen funds, first through THORChain into Ethereum and now through Bitcoin CoinJoin transactions.

The research identified 293 separate 2-of-2 multisig vaults created by the attacker, with each vault corresponding to a victim or group of victim funds. About 208.24 BTC was consolidated from 1,912 victim addresses into these collection addresses.

The attacker has been spending the vaults in order of their original contents, with the largest vault's 20.50 BTC being routed through THORChain on September 2nd and subsequent moves totaling 97.09 BTC in five days.