Third-Wave Coldcard Hack Attacker Moves 45% of Stolen BTC
The third-wave attacker behind the Coldcard wallet hack has moved approximately 45% of their Bitcoin (BTC) haul, according to Galaxy Research. The funds were routed through THORChain or into CoinJoin transactions.
The exploiter began moving funds to Ethereum through THORChain on September 2. This movement sent Bitcoin into CoinJoin rounds, combining multiple users' payments into a single transaction to make tracing more difficult.
Galaxy said the third-wave exploiter created 293 two-of-two multisignature vaults to hold victims' coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved.
The transactions helped Galaxy identify a previously unknown vault that likely held another Coldcard victim's funds, although the cause of that loss remains unconfirmed.