Key facts
- The Coldcard wallet attacker has moved approximately 45% of the stolen Bitcoin from the third wave of thefts.
- The funds, valued at around $7.7 million, were moved via THORChain and into CoinJoin transactions.
- The attacker created 293 two-of-two multisignature vaults to hold the stolen coins.
- Across all waves of the Coldcard exploit, 82% of the stolen Bitcoin remains in the attacker-controlled addresses.
- The Coldcard exploit is ranked as the third-largest exploit in 2026.
The attacker behind the third wave of thefts from Coldcard hardware wallets has moved 97.09 BTC, approximately 45% of that wave's haul and about $7.7 million at Monday's prices, according to Galaxy Research. The first exit occurred on September 2, when around 20.5 BTC from the largest vault went through THORChain and emerged as Ethereum. Subsequent transactions on Sunday night involved sending Bitcoin into CoinJoin rounds, a privacy technique that pools transactions from multiple users to obscure the trail between inputs and outputs. Of the funds moved, only 20.56 BTC actually reached Ethereum, while another 57.24 BTC remains as CoinJoin change. Galaxy noted that the attacker constructed 293 two-of-two multisig vaults and has been emptying them in order of size, with eleven now empty. Across all identified waves of the Coldcard exploit, 82% of the stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has been moved for laundering. The Coldcard exploit is ranked as the third-largest exploit in 2026, following the $293 million Kelp DAO hack and the $280 million Drift protocol hack.