Coldcard Hackers Transfer 45% of Stolen Funds Through Mixing Transactions
The attackers behind the 'Wave 3' Coldcard hack are still transferring stolen funds. According to Galaxy Research, the hackers created 293 separate 2-of-2 multisig wallets for each victim's assets during this phase of the attack. The first batch of funds was transferred via THORChain to Ethereum, while the latest round is being processed through CoinJoin mixing transactions.
The attackers are prioritizing the largest sums, transferring funds from the top-ranked wallets in order. Currently, 45% of the stolen assets have been moved, with approximately $80,226 worth of Bitcoin still remaining in the untransferred wallets.
Researchers have also discovered an unknown wallet containing 58 addresses, which is believed to be linked to the Wave 3 attack.
About 82% of the stolen Bitcoin remains in the attackers' initial control addresses, while approximately 18% has been transferred. The funds are being routed through various paths, suggesting potential money laundering activities.