Coldcard Exploiter Moves Funds Through CoinJoin Rounds

The attacker behind the third wave of Coldcard wallet thefts has started moving more Bitcoin. According to Galaxy Research, which monitors on-chain activity, the exploiter has sent funds through THORChain to Ethereum and into CoinJoin rounds.

The first movements in this wave occurred on September 2, when coins were transferred through THORChain and arrived on Ethereum. Subsequent transfers entered CoinJoin rounds, making it more difficult for investigators to trace the funds.

CoinJoin combines inputs and outputs from multiple participants in one Bitcoin transaction, complicating straightforward analysis of the transaction graph. While this makes attribution more challenging, investigators can still use timing, amounts, and later spending behavior to track the funds.