Coldcard Thief Shifts $7.7M in Bitcoin Through THORChain, CoinJoin

The third wave of the Coldcard theft continues to unfold as Galaxy Research tracks fresh movements from the exploiter who has begun shifting significant portions of stolen Bitcoin. The latest activity shows the attacker moving 97.09 BTC, worth $7.7 million, through THORChain and CoinJoin transactions.

Galaxy said the exploiter started routing funds on Sept. 2, sending 20.5 BTC from the largest vault through THORChain, with proceeds landing on Ethereum. Days later, the attacker shifted 15.48 BTC from the second-largest vault into a CoinJoin transaction, followed by another 61.12 BTC from 10 vaults.

CoinJoin mixes payments from multiple users, making it harder to link inputs and outputs, and Galaxy believes these steps were taken to obscure the trail. The exploiter has now emptied the 11 largest vaults, and the next 10 contain 30.81 BTC. Vaults ranked 61 through 293 hold a combined 33.77 BTC.