preferred on
Point of Focus
- The Coldcard Wave 3 attacker has moved roughly 45% of the stolen Bitcoin.
- Stolen BTC has been routed through THORChain into Ether and through CoinJoin transactions.
- However, about 82% of stolen BTC remains unmoved.
The attacker behind the third wave of the Coldcard hardware-wallet exploit has moved approximately 45% of the Bitcoin stolen in that phase, escalating efforts to obscure the funds weeks after the original theft.
According to Galaxy Research, the Wave 3 attacker has moved approximately 97.09 BTC, worth around $7.8 million, over the past five days.
The funds have followed two routes: some Bitcoin was swapped into Ether through THORChain, while another portion entered CoinJoin transactions designed to make transaction tracing more difficult.
The activity marks a significant development in an exploit that has resulted in more than $100 million in confirmed Bitcoin losses across multiple attack waves.
Hacker moves through Coldcard’s largest vaults
Galaxy said the Wave 3 attacker created 293 separate 2-of-2 multisignature vaults, with each vault holding funds associated with an individual victim.
Rather than moving the Bitcoin randomly, the attacker has been processing the vaults in descending order by balance. Funds from the 11 largest vaults have now moved.
Coldcard ‘Wave 3’ exploiter continues to move funds
In wave 3, the exploiter created 293 2-of-2 multisig vaults for each victim’s coins.
The first movements on 9/2 sent coins over THORChain to Ethereum.
Tonight’s movements are going into coinjoins rounds. pic.twitter.com/H7HIpcI7ah
— Galaxy Research (@glxyresearch) September 7, 2026
The next 10 untouched vaults collectively contain 30.81 BTC, while vaults ranked 61 through 293 contain another 33.77 BTC.
The transfers also helped researchers identify an additional cluster involving 58 addresses that spend through the same 2-of-2 multisignature structure.
Galaxy has not confirmed that this cluster resulted from the Coldcard vulnerability, meaning its cause remains open.
If ultimately linked to the exploit, it would increase the Wave 3 vault count from 293 to 294 and push total Coldcard-related losses to approximately 1,806 BTC.
THORChain and CoinJoin complicate the fund trail
The first identified cross-chain movement began on Sept. 2, when stolen BTC was routed through THORChain and exchanged for Ether.
Further movements on Sept. 5 and Sept. 6 sent Bitcoin into CoinJoin transactions.
COLDCARD WAVE 3 HACKER SWAPS FUNDS TO ETH VIA THORCHAIN
the wave 3 exploiter has moved stolen funds for the first time, swapping to ETH them through the THORChain cross-chain DEX
these are the first funds from wave 1, 2, or 3 to move onchain from the original hacker addresses pic.twitter.com/jjOrX5wBR9
— Alex Thorn (@intangiblecoins) September 2, 2026
CoinJoin combines inputs and outputs from multiple participants into the same transaction, making it harder to establish which output belongs to a particular sender.
The two methods therefore create different tracing challenges: THORChain moves value between blockchains, while CoinJoin attempts to weaken the transaction trail within Bitcoin itself.
82% of stolen Coldcard Bitcoin has not moved
Despite the latest activity, most of the Bitcoin stolen across the Coldcard attacks remains stationary.
Galaxy estimates that 82% of the stolen BTC remains in the original attacker-controlled addresses, while approximately 18% has moved in transactions researchers characterize as apparent laundering activity.
Confirmed losses currently stand at approximately 1,789 BTC across 8,865 affected addresses, worth about $114.7 million at the time of theft.
The first attack wave alone drained 1,082.65 BTC in just 41 minutes. Galaxy’s analysis indicates that at least 15 separate attackers participated across the attacks between July 30 and Aug. 6.
Share
Most read articles
