Over a month after the Coldcard exploit, the attacker continues actively moving stolen Bitcoin through various transaction paths, according to analysis published by Galaxy Research on September 7.
The attacker first consolidated approximately 208.24 BTC from roughly 1,912 victim addresses into 293 collection addresses, each funding a separate 2-of-2 multisig vault. The vaults were then systematically accessed in descending order by holdings.
Recent Fund Movements
The largest vault exit occurred on September 2, when 20.50 BTC was routed through THORChain into Ethereum before being moved again through two addresses that have since been emptied.
The attacker subsequently shifted tactics to Bitcoin CoinJoin transactions, which mix multiple users' inputs and outputs to obscure transaction trails. Approximately 15.48 BTC was moved via CoinJoin on September 5, followed by 61.12 BTC on September 6, with some funds entering CoinJoin rounds through intermediate addresses.
Across these three major movements spanning five days, the attacker moved 97.09 BTC in total, leaving approximately 116.98 BTC untouched in the Wave 3 vaults—roughly 45% of the 214.07 BTC originally stored there.
Current Status
Galaxy Research identified a previously unknown vault containing funds from 58 addresses that matched the same 2-of-2 multisig pattern and linked to CoinJoin activity. If confirmed as another Coldcard victim vault, the total would potentially reach approximately 1,806 BTC across 294 vaults.
Currently, approximately 82% of coins stolen in the Coldcard exploit remain held in original attacker-controlled addresses, while 18% has been moved apparently for laundering purposes.
