Coldcard Exploiter Moves 45% of Wave 3 Loot as Stolen Bitcoin Enters CoinJoins

Across all attack waves, 82% of stolen coins remain in attacker-controlled addresses, while 18% have been moved for laundering.

The exploiter linked to the third wave of attacks on Coldcard wallets has now moved 45% of the coins stolen, according to Galaxy Research.

The firm said the funds have been transferred either to Ethereum through THORChain or into Coinjoin, in an effort to launder the stolen assets. During Wave 3, the exploiter created 293 2-of-2 multisig vaults for victims’ coins.

Wave 3 Haul

The first movements on September 2 sent funds through THORChain to Ethereum, while the latest activity has moved into Coinjoin rounds. Galaxy Research said the operator has been systematically spending the largest share of the thefts according to their size ranking. Ranks 1 through 11 have already been moved.

The next 10 unmoved vaults contain 30.81 BTC, while ranks 61 through 293 hold a combined 33.77 units. The latest transactions led Galaxy to identify a previously unknown vault linked to 58 addresses that are likely associated with Coldcard victims.

Most of the funds stolen in the Coldcard exploit have yet to move. In fact, approximately 82%, across all waves, are still held in the attacker-controlled addresses where the coins were initially stored. The remaining 18% has already been moved, and the transfers are apparently linked to efforts to launder the exploit’s haul.