Written by Zoltan Vardaistaff writerReviewed by Yohan Yunstaff editor
Written by Zoltan Vardaistaff writer
Reviewed by Yohan Yunstaff editor
Coldcard third-wave attacker moves 45% of stolen Bitcoin
Latest NewsPublishedSep 7, 2026
Galaxy stated 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering.
The exploiter behind the third wave of the Coldcard wallet hack has moved about 45% of their Bitcoin (BTC) haul, routing the funds through THORChain or into CoinJoin transactions, as reported by Galaxy Research.
In a Monday update, Galaxy stated the exploiter began moving funds to Ethereum through THORChain on Sept. 2. The latest movements sent Bitcoin into CoinJoin rounds, which combine multiple users’ payments into a single transaction to make funds harder to trace.
Galaxy stated the third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims’ coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved.
The transactions helped Galaxy identify a previously unknown vault that it stated likely held another Coldcard victim’s funds, although the cause of that loss remained unconfirmed.
Across all waves of the Coldcard exploit, approximately 82% of the stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has moved, apparently for laundering purposes, Galaxy stated.
The Coldcard exploit ranks as the third-largest exploit so far in 2026, behind a $293 million Kelp DAO hack and the $280 million Drift protocol hack, as reported by DefiLlama.
Related: Trezor says data breach affects another 67K US customers
Subscribe to daily byte-sized crypto news from Cointelegraph
Subscribe
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
- Bitcoin Wallet
- Hardware Wallet
- Hackers
- Hacks
- Scams
- Cybersecurity
- Self Custody
- Scams & Cybercrime
More on the subject
Trezor says data breach affects another 67K US customers
Sep 4, 2026
Zoltan Vardai
US, UK launch joint alliance targeting crypto scam centers
Sep 4, 2026
Ezra Reguerra
Thai businessmen sue Tether for freezing $42M USDT
Sep 2, 2026
Zoltan Vardai
Trezor says data breach affects another 67K US customers
Sep 4, 2026
Zoltan Vardai
US, UK launch joint alliance targeting crypto scam centers
Sep 4, 2026
Ezra Reguerra
Thai businessmen sue Tether for freezing $42M USDT
Sep 2, 2026
Zoltan Vardai
