THORChain and CoinJoin Used in Coldcard Hack Cashing Out Stolen Bitcoin

A hacker behind the third wave of Coldcard hardware wallet exploits has started cashing out, routing approximately 97.09 BTC through cross-chain swaps and mixing services over a five-day window.

Galaxy Research flagged the movement on September 7, noting it represents roughly 45% of the Wave 3 stolen funds.

The funds first hit THORChain on September 2, where they were swapped into Ether. By September 5 and 6, additional portions had been run through CoinJoin transactions, a Bitcoin privacy technique that bundles multiple users' transactions together to obscure the trail.

The attacker appears to be working through the largest vaults first, a prioritization strategy that suggests deliberate planning rather than panicked liquidation. This raises questions about the level of sophistication and resources behind these attacks.