Home›Crypto›Market Structure›Coldcard attacker moves about 45% of stolen Bitcoin vi…

Coldcard attacker moves about 45% of stolen Bitcoin via mixers

Galaxy Research said 82% of the stolen BTC remains in the original attacker-controlled addresses, while 18% has moved for apparent laundering.

Reported · Written up by our desk · Market Structure

Crypto security firm Galaxy Research said the Coldcard wallet hack’s third-wave attacker has started moving roughly 45% of their Bitcoin haul, shifting funds through THORChain and into CoinJoin transactions to make them harder to trace.

Galaxy said the attacker began sending funds to Ethereum via THORChain on Sept. 2, then routed the resulting Bitcoin into CoinJoin rounds that combine multiple users’ payments in a single transaction.

Galaxy Research added that the attacker created 293 two-of-two multisignature vaults to hold victims’ coins, and that they have been emptied in descending order of size, with funds from the 11 largest vaults already moved.

Across all waves of the Coldcard exploit, Galaxy said about 82% of the stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has moved, which it described as apparent laundering. The hack ranks as the third-largest exploit in 2026, behind a $293 million Kelp DAO incident and the $280 million Drift protocol hack, according to DefiLlama.

Latest closeBitcoin $79,153.04 ▼1.5%|Ethereum $2,494.50 ▼0.8%

More like this

Sources