Crypto
Coldcard Hacker Transfers 45% of Stolen Bitcoin Through THORChain
A hacker behind the third wave of attacks on the Coldcard wallet has transferred around 45% of the stolen Bitcoin, using THORChain and CoinJoin transactions to obfuscate the flow of funds.
The attack, which occurred in September 2026, saw the hacker create 293 two-of-two multisig vaults for each victim's coins, allowing them to transfer funds from the largest vaults first.
According to Galaxy Research, the bulk of the stolen Bitcoin remains in attacker-controlled addresses, with only 18% having been laundered. This makes the exploit one of the biggest cryptocurrency hacks of 2026, ranking third behind Kelp DAO and Drift Protocol.