Coldcard third-wave attacker moves 45% of stolen Bitcoin
Galaxy said 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering.
The third wave of the Coldcard wallet hacking attack has resulted in the movement of approximately 45% of the stolen Bitcoin (BTC), according to Galaxy Research. The attacker has been routing the funds through THORChain and into CoinJoin transactions to launder the stolen assets. Galaxy reports that the exploiter initiated the fund transfers to Ethereum on September 2.
By creating 293 two-of-two multisignature vaults, the attacker has moved funds from the largest vaults, in descending order of size. So far, the transactions have moved the funds from the 11 largest vaults. By analyzing these movements, Galaxy identified a previously unknown vault that likely held another Coldcard victim's funds, though the cause of this loss remains unverified.
In total, about 82% of the stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has been moved, likely for the purpose of laundering. The Coldcard exploit is currently the third-largest of its kind in 2026, surpassed only by a $293 million Kelp DAO hack and a $280 million Drift protocol hack, as reported by DefiLlama.
Written by urgent.news from Cointelegraph's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.