Third-Wave Coldcard Hacker Moves 45% of Stolen Bitcoin Through THORChain

The hacker behind the third wave of the Coldcard wallet exploit has moved approximately 45% of their stolen Bitcoin, according to Galaxy Research.

The funds were routed through THORChain or into CoinJoin transactions, which combine multiple users' payments into a single transaction to make them harder to trace.

Galaxy said the hacker had created 293 two-of-two multisignature vaults to hold victims' coins and was moving funds from the largest vaults in descending order of size.

The transactions helped Galaxy identify a previously unknown vault that likely held another Coldcard victim's funds, although the cause of that loss remains unconfirmed.