Coldcard Wave 3 Exploiter Moves Funds Through CoinJoin

The attacker associated with the third wave of Coldcard wallet thefts has begun moving more bitcoin, routing earlier transfers through THORChain to Ethereum and sending newer movements into CoinJoin rounds. Galaxy Research described the activity in a Sept.

7 on-chain update and said the exploiter had created 293 two-of-two multisignature vaults for victims’ coins. The update documents wallet behavior, not the attacker’s identity or intent.

Moving funds through cross-chain infrastructure and collaborative Bitcoin transactions can complicate tracing, but it does not by itself prove that the proceeds have been successfully laundered.

Wave 3 funds start leaving their vaults Galaxy said the first movements in this wave occurred on Sept. 2, when coins were sent through THORChain and arrived on Ethereum. The research firm then observed subsequent transfers entering CoinJoin rounds.