Coldcard third-wave attacker moves 45% of stolen Bitcoin

The exploiter behind the third wave of the Coldcard hardware‑wallet hack has begun moving a substantial portion of the stolen Bitcoin, according to a recent analysis by Galaxy Research.

Scale of the movement

Approximately 45% of the Bitcoin seized in this wave has been transferred, with the funds routed through THORChain to Ethereum and into CoinJoin transactions designed to obscure their trail.

Methodology

Galaxy identified that the attacker created 293 two‑of‑two multisignature vaults to store victims’ coins. Movements have proceeded from the largest vaults downward, and funds from the 11 biggest vaults have already been shifted.

Overall Coldcard impact

Across all Coldcard exploit waves, about 82% of the stolen Bitcoin remains in the attacker‑controlled addresses, while roughly 18% has been moved in what appears to be laundering activity.

Context within 2026 exploits

The Coldcard incident ranks as the third‑largest crypto exploit of 2026, following the $293 million Kelp DAO hack and the $280 million Drift protocol breach.