Coldcard Exploiter Moves 45% of Stolen Coins as Efforts to Launder Continue

The exploiter behind the third wave of attacks on Coldcard wallets has moved 45% of the stolen coins, according to Galaxy Research.

This movement includes transferring funds either through THORChain to Ethereum or into Coinjoin rounds in an effort to launder the stolen assets.

The attack began on July 30, 2026, and targeted Coldcard wallets with a firmware flaw that had existed for years, causing wallets to use a weak software random generator instead of their hardware-based source, weakening seed security from 128 bits to as low as 40 bits on older devices.

Despite the attack, Bitcoin's price remained largely unaffected, posting an impressive rally nearing $82,000 last month before pulling back to around $79,500 at the time of writing.