Third-Wave Coldcard Hacker Moves Nearly Half Stolen Bitcoin Through THORChain

The third-wave attacker behind the Coldcard wallet hack has moved approximately 45% of their Bitcoin (BTC) haul, routing funds through THORChain or into CoinJoin transactions.

Galaxy Research reported that the exploiter began moving funds to Ethereum via THORChain on September 2. The latest movements sent Bitcoin into CoinJoin rounds, combining multiple users' payments into a single transaction to make tracing harder.

The third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims' coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved, according to Galaxy.

The transactions helped identify a previously unknown vault likely holding another Coldcard victim's funds, though the cause remains unconfirmed. Across all waves of the Coldcard exploit, approximately 82% of stolen Bitcoin remains in original attacker-controlled addresses, while 18% has moved for laundering purposes, Galaxy said.