Coldcard Hacker Moves 45% of Stolen Bitcoin Through THORChain

• Third-wave Coldcard hacker has already transferred roughly 45% of the stolen Bitcoin through THORChain and CoinJoin transactions.
• According to Galaxy, 82% of stolen Bitcoin from Coldcard hacks has remained in the possession of attackers.

The perpetrator of the third wave attack against the Coldcard wallet has escalated the pace of transferring funds, reports Galaxy Research. The exploiters have transferred approximately 45% of the Bitcoin stolen from the third wave so far. These transfers indicate a pattern of using methods that make blockchain tracking difficult.

The perpetrator moved Bitcoin to Ethereum through THORChain on September 2. Recent transactions involved moving Bitcoin via CoinJoin rounds. CoinJoin is a process whereby payments from different users are included in a transaction. This makes it more difficult to track transactions of individual fund transfers on the Bitcoin blockchain. It now provides researchers with insight into how the attacker operates the stolen funds.

Two-of-Two Multisignature Vaults Indicate Attack Plan

According to Galaxy, the third-wave attacker opened 293 multisignature two-of-two vaults. These were vaults with Bitcoin stolen from Coldcard victims. So far, the funds have been transferred from the biggest vaults in decreasing order of their sizes. According to Galaxy, funds from the 11 biggest vaults have already been transferred.