Coldcard Hacker Transfers 45% of Stolen Bitcoins Through THORChain

The third-wave Coldcard hacker has been moving stolen Bitcoin at an accelerated pace through THORChain and CoinJoin transactions. According to Galaxy Research, approximately 45% of the stolen Bitcoin has been transferred so far.

The attacker used a method that makes blockchain tracking difficult by creating 293 two-of-two multisignature vaults for each victim's coins. The first movements on September 2 sent coins over THORChain to Ethereum, while recent transactions involved moving Bitcoin via CoinJoin rounds.

Despite the active fund movement activity, the bulk of the stolen Bitcoin remains in the initial attack-controlled addresses, with 82% still lying there. The remaining 18% has been transferred in transactions indicative of laundering.