Coldcard Exploit Attacker Moves 45% of Stolen Bitcoin

The attacker behind the third wave of Coldcard wallet exploits has started to move their stolen Bitcoin. According to Galaxy Research, the exploiter has transferred around 45% of the coins taken during Wave 3. The funds were sent either through THORChain to Ethereum or into Coinjoin for laundering purposes.

The latest transactions revealed a previously unknown vault linked to 58 addresses likely associated with Coldcard victims. Most of the stolen Bitcoin remains in attacker-controlled addresses, with only 18% having been moved so far.

The attack began on July 30, 2026, and targeted wallets with a firmware flaw from a March 2021 update that made them vulnerable to brute-force key attacks. Despite the exploit's significant impact on affected users, Bitcoin's price remained unaffected, even reaching an impressive rally near $82,000 last month.