Third-Wave Coldcard Hacker Moves $1.4B in Stolen Bitcoin

The third-wave attacker in the Coldcard wallet hack has moved approximately 45% of their stolen Bitcoin funds, according to Galaxy Research.

The exploiter began routing the funds through THORChain or into CoinJoin transactions on September 2, with the latest movements sending Bitcoin into CoinJoin rounds.

Galaxy identified that the attacker had created 293 two-of-two multisignature vaults to hold victims' coins and was moving funds from the largest vaults in descending order of size.

Funds from the 11 largest vaults have now been moved, leaving about 82% of the stolen Bitcoin remaining in the original attacker-controlled addresses.