Coldcard Exploiter Moves 45% of Stolen Bitcoin, Laundering Efforts Underway

The exploiter linked to the third wave of attacks on Coldcard wallets has now moved a significant portion of the stolen funds, according to Galaxy Research. The firm reported that approximately 45% of the coins from Wave 3 have been transferred either through THORChain to Ethereum or into Coinjoin, in an effort to launder the stolen assets.

During Wave 3, the exploiter created a large number of 2-of-2 multisig vaults for victims' coins. The exact number was 293. This move was likely done to make it difficult for the rightful owners to access their funds.

The stolen Bitcoin has entered the Coinjoin system, which is designed to anonymize transactions and make them more difficult to track. However, this process does not completely eliminate the risk of detection, as law enforcement agencies have been known to successfully identify and recover funds from these platforms.