Coldcard Wave 3 Exploiter Moves Funds Through CoinJoin

The attacker associated with the third wave of Coldcard wallet thefts has begun moving more bitcoin, routing earlier transfers through THORChain to Ethereum and sending newer movements into CoinJoin rounds. Galaxy Research described the activity in a Sept. 7 on-chain update and said the exploiter had created 293 two-of-two multisignature vaults for victims’ coins.

The update documents wallet behavior, not the attacker’s identity or intent. Moving funds through cross-chain infrastructure and collaborative Bitcoin transactions can complicate tracing, but it does not by itself prove that the proceeds have been successfully laundered.

Wave 3 funds start leaving their vaults

Galaxy said the first movements in this wave occurred on Sept. 2, when coins were sent through THORChain and arrived on Ethereum. The research firm then observed subsequent transfers entering CoinJoin rounds. Its public post did not provide a final amount moved or say that every vault had been emptied.

A CoinJoin combines inputs and outputs from multiple participants in one Bitcoin transaction. That construction makes straightforward transaction-graph analysis more difficult because an observer cannot simply assume that each input maps to a specific output. Investigators can still use timing, amounts and later spending behavior, but confidence in attribution can fall.