Coldcard Hacker Moves 45% of Bitcoin Stolen in Third Attack Wave

The operator behind the third wave of the Coldcard thefts moved 97.09 BTC between September 2 and September 6, routing funds through THORChain and CoinJoin transactions. The transfers account for about 45% of the Bitcoin taken in that wave, according to CoinDesk.

The activity marks a concentrated effort to move a sizeable portion of the Wave 3 proceeds. Yet the broader estimated Coldcard haul remains largely parked in original attacker-controlled addresses, based on Galaxy Research’s tracking.

THORChain and CoinJoin received 97.09 BTC from Wave 3

On September 2, the Wave 3 operator transferred about 20.5 BTC through THORChain into Ethereum. Three days later, 15.48 BTC entered CoinJoin transactions, followed on September 6 by a further 61.12 BTC drawn from 10 additional vaults.

Together, those transactions totalled 97.09 BTC. The sequence used two distinct routes: a cross-chain transfer into Ethereum through THORChain and privacy-focused CoinJoin transactions on Bitcoin.

CoinJoin combines inputs from multiple users into joint transactions, making on-chain tracing more difficult than following a straightforward wallet-to-wallet transfer. The available reporting identifies the destinations and amounts, but does not establish what the operator intended to do with the transferred funds after the movements.

… Continue reading the full article at the original source below.