Hacker Behind Coldcard's Third Attack Wave Transfers Nearly Half of Stolen BTC
According to Galaxy Research, the perpetrator of Coldcard's third wave of thefts has transferred 45% of the stolen cryptocurrency via THORChain and CoinJoin mixing services.
The malicious actor responsible for the third wave of attacks on Coldcard wallet users has transferred approximately 45% of the stolen Bitcoin (BTC), channeling the digital assets through THORChain or directing them into CoinJoin mixing transactions, based on findings from Galaxy Research.
In an update released on Monday, Galaxy Research revealed that the malicious actor initiated the transfer of assets to Ethereum via THORChain on Sept. 2. The most recent fund movements involved sending Bitcoin into CoinJoin mixing rounds, a privacy technique that merges payments from multiple participants into one transaction to obscure the traceability of the funds.
According to Galaxy Research, the perpetrator of the third attack wave had established 293 two-of-two multisignature vaults for storing the cryptocurrency belonging to victims and was transferring assets from the largest vaults in a pattern of descending size. Assets from the 11 most substantial vaults have now been transferred.
The transaction activity enabled Galaxy Research to discover a vault that was previously unidentified, which the firm stated likely contained funds belonging to another Coldcard victim, though the specific cause behind that particular loss has not been confirmed.
Looking at all waves of the Coldcard security breach combined, roughly 82% of the stolen Bitcoin continues to sit in the original addresses controlled by the attacker, while 18% has been moved, presumably as part of laundering efforts, according to Galaxy Research.
The Coldcard security breach is ranked as the third-largest exploit in 2026 to date, trailing behind a $293 million Kelp DAO hack and the $280 million Drift protocol hack, based on data from DefiLlama.