Coldcard attacker moves 45% of stolen bitcoin

The attacker linked to the third wave of the Coldcard wallet exploit has moved about 45% of the stolen bitcoin, according to Galaxy Research. The funds were routed through THORChain and later sent into CoinJoin transactions, which are designed to make blockchain tracing more difficult. Galaxy said the attacker began shifting funds to Ethereum via THORChain on Sept. 2, then continued moving bitcoin through CoinJoin rounds. The firm also said the attacker created 293 twooftwo multisignature vaults to store stolen coins and has been draining them from the largest vaults first. Across all Coldcard attack waves, Galaxy estimates that about 82% of the stolen bitcoin still sits in the original attackercontrolled addresses, while 18% has moved and appears to be related to laundering activity. The exploit is now ranked among the largest hacks of 2026.