Coldcard third-wave attacker moves 45% of stolen Bitcoin
Galaxy said 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering.
The exploiter behind the third wave of the Coldcard wallet hack has moved about 45% of their Bitcoin (BTC) haul, routing the funds through THORChain or into CoinJoin transactions, according to Galaxy Research.
In a Monday update, Galaxy said the exploiter began moving funds to Ethereum through THORChain on Sept. 2. The latest movements sent Bitcoin into CoinJoin rounds, which combine multiple users’ payments into a single transaction to make funds harder to trace.
Galaxy said the third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims’ coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved.