Coldcard 'Wave 3' Attacker Continues to Launder Stolen Bitcoin
The Coldcard 'Wave 3' attacker has continued to move Bitcoin funds more than a month after the exploit occurred. According to Galaxy Research, the attacker first moved the stolen funds through THORChain into Ethereum, and now the laundering is happening through Bitcoin CoinJoin transactions.
Galaxy Research analyzed on-chain activity and found that the attacker consolidated 208.24 BTC from 1,912 victim addresses into 293 collection addresses. Each collection address then funded one of these vaults, creating a structured system for storing the stolen BTC.
The first major exit came on September 2nd when the largest vault's 20.50 BTC was routed through THORChain into Ethereum. Two Ethereum addresses receiving the funds have since been emptied. The attacker then shifted to CoinJoin, which mixes multiple users' Bitcoin inputs and outputs, making individual funds harder to trace.
Across three major movements, the attacker was able to move 97.09 BTC in five days, leaving about 116.98 BTC untouched in the Wave 3 vaults. This means roughly 45% of the 214.07 BTC in these vaults has already been moved.