The attacker responsible for the third wave of the Coldcard wallet breach has transferred approximately 45% of the stolen Bitcoin. According to Galaxy Research, the funds were routed through the THORChain protocol or processed via CoinJoin transactions to obscure their origin.
The movement of assets began on September 2, with the exploiter shifting funds to Ethereum using THORChain. The perpetrator utilized 293 two-of-two multisignature vaults to store the illicitly obtained coins, systematically emptying the largest vaults first. To date, assets from the 11 biggest vaults have been transferred.
These transactions enabled Galaxy Research to discover an additional vault, which likely contains funds from another victim of the Coldcard exploit. While the exact cause of this specific loss remains unverified, it has been linked to the broader pattern of the attack.
Data from Galaxy Research indicates that across all waves of the Coldcard incident, 82% of the stolen Bitcoin remains in the original addresses controlled by the attacker. Only 18% of the total stolen volume has been moved for apparent laundering activities.
DefiLlama reports that the Coldcard exploit is currently the third-largest security incident of 2026. It follows the Kelp DAO hack, which resulted in losses of $293 million, and the Drift protocol hack, which saw $280 million stolen.
