Coldcard Exploiter Moves 97 Bitcoin Through CoinJoin, Galaxy Says

The attacker behind the third wave of thefts targeting Coldcard hardware wallets has moved 97.09 Bitcoin (BTC), worth roughly $7.8 million, through the privacy tool CoinJoin, according to Galaxy Research. The transfer represents about 45% of the funds stolen in that specific cluster of attacks, the firm said.

The latest movement, identified on September 6, followed an earlier transaction on September 2 in which the exploiter converted part of the haul into Ethereum via the cross-chain swap protocol THORChain. Galaxy's analysis indicates the operator is working through compromised wallets in a deliberate sequence, starting with those holding the largest balances.

Vaults ranked first through eleventh by value have already recorded outflows tied to the laundering effort. The next ten untouched vaults contain a combined 30.81 BTC, while a broader group of smaller vaults, ranked 61 through 293, collectively holds 33.77 BTC. The pattern gives blockchain investigators a potential roadmap for which addresses the attacker may target next.

Across the entire Coldcard campaign, approximately 82% of stolen funds still sit in the original attacker-controlled addresses where they were first deposited. The remaining 18% has been moved through transactions that appear connected to laundering or asset conversion, according to the research.