Coldcard Hacker Moves Nearly Half of Stolen Bitcoin Through THORChain and CoinJoin

The hacker behind the third wave of the Coldcard thefts has moved a significant portion of the stolen Bitcoin, totaling 97.09 BTC or about 45% of the Wave 3 proceeds.

This movement occurred between September 2 and September 6, with funds routed through THORChain and CoinJoin transactions.

The attacker used two distinct routes: a cross-chain transfer into Ethereum through THORChain and privacy-focused CoinJoin transactions on Bitcoin.

CoinJoin combines inputs from multiple users into joint transactions, making on-chain tracing more difficult than following a straightforward wallet-to-wallet transfer.

According to Galaxy Research's tracking, the transferred funds did not come evenly from the addresses linked to the third attack wave. The attacker emptied 11 of the largest 293 Wave 3 vaults, leaving a substantially smaller balance in the next tier of wallets.