The exploiter responsible for the third wave of the Coldcard wallet hack has moved about 45% of their stolen Bitcoin haul, utilizing THORChain and CoinJoin transactions, according to a Monday update from Galaxy Research.
Galaxy reported that the exploiter began shifting funds to Ethereum via THORChain on Sept. 2. More recent movements have involved routing Bitcoin into CoinJoin rounds, a process that combines multiple users' payments into a single transaction to obscure the trail of funds.
According to Galaxy, the third-wave exploiter established 293 two-of-two multisignature vaults to store victims' coins. The attacker has been transferring funds from these vaults in descending order of size, with assets from the 11 largest vaults now moved.
These transactions enabled Galaxy to identify a previously unknown vault that likely contains funds from another Coldcard victim, though the exact cause of that specific loss remains unconfirmed.
Across all waves of the Coldcard security incident, Galaxy noted that roughly 82% of the stolen Bitcoin stays in the original attacker-controlled addresses, while 18% has been moved for apparent laundering purposes. DefiLlama data indicates that the Coldcard exploit stands as the third-largest exploit of 2026, following the $293 million Kelp DAO hack and the $280 million Drift protocol hack.
