Coldcard Exploiter Moves 45% of Wave 3 Loot as Stolen Bitcoin Enters CoinJoins

The exploiter linked to the third wave of attacks on Coldcard wallets has now moved 45% of the coins stolen, according to Galaxy Research.

The firm said the funds have been transferred either to Ethereum through THORChain or into Coinjoin, in an effort to launder the stolen assets. During Wave 3, the exploiter created 293 2-of-2 multisig vaults for victims’ coins.

Wave 3 Haul The first movements on September 2 sent funds through THORChain to Ethereum, while the latest activity has moved into Coinjoin rounds. Galaxy Research said the operator has been systematically spending the largest share of the thefts according to their size ranking.

Ranks 1 through 11 have already been moved.