Coldcard Wallet Hack: 45% of Stolen BTC Moved Through THORChain

The third-wave attacker behind the Coldcard wallet hack has moved about 45% of their Bitcoin (BTC) haul, routing funds through THORChain or into CoinJoin transactions.

According to Galaxy Research, the exploiter began moving funds to Ethereum through THORChain on September 2. This recent movement sent Bitcoin into CoinJoin rounds, which combine multiple users' payments into a single transaction to make funds harder to trace.

Galaxy stated that the third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims' coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved.

The transactions helped Galaxy identify a previously unknown vault that it said likely held another Coldcard victim's funds, although the cause of that loss remained unconfirmed.