Coldcard Hacker Moves $270M of Stolen Bitcoin via Complex Transactions

The hacker behind the recent wave of Coldcard wallet attacks has moved about 45% of the stolen Bitcoin using THORChain and CoinJoin, making it difficult to track on the blockchain. Galaxy Research reports that a significant portion of the stolen funds remains unmoved in attacker-controlled addresses, with 82% still untouched.

The attacker created 293 multisignature vaults to manage the stolen funds and has been transferring coins from the largest vaults first. This activity is helping investigators identify patterns in laundering stolen cryptocurrency, highlighting the scale and sophistication of the exploit, which is among the largest crypto thefts in 2026.