Coldcard Hacker Transfers $45M of Stolen Bitcoin Through THORChain

The third-wave Coldcard hacker has been moving funds quickly, transferring approximately 45% of the stolen Bitcoin through THORChain and CoinJoin transactions.

According to Galaxy Research, the attacker created 293 two-of-two multisignature vaults for each victim's coins. The first movements on September 2 sent coins over THORChain to Ethereum, while recent transactions involved moving Bitcoin via CoinJoin rounds.

CoinJoin is a process that combines payments from different users in a single transaction, making it more difficult to track individual fund transfers on the Bitcoin blockchain. This has provided researchers with insight into how the attacker operates the stolen funds.