More than a month after the Coldcard exploit, the attacker has not stopped moving funds. A September 7 analysis from Galaxy Research shows the “Wave 3” attacker initially routed stolen Bitcoin through THORChain into Ethereum before shifting to Bitcoin CoinJoin transactions for laundering. The attacker consolidated 208.24 BTC from roughly 1,912 victim addresses into 293 multisig vaults, spending them in descending order of size. Across three major movements in five days, 97.09 BTC was moved, leaving about 116.98 BTC untouched. Approximately 82% of all coins stolen in the exploit remain held in original attacker-controlled addresses, while 18% has been moved for laundering purposes.
The Coldcard “Wave 3” attacker continues to move stolen Bitcoin more than a month after the exploit, according to a September 7 analysis from Galaxy Research. The attacker initially routed funds through THORChain into Ethereum but has now shifted to CoinJoin transactions for laundering.
On-chain activity shows the attacker created 293 separate 2-of-2 multisig vaults, with each vault corresponding to a victim or group of victim funds. Approximately 208.24 BTC was consolidated from roughly 1,912 victim addresses into 293 collection addresses before funding these vaults.
The vaults were ranked according to their original BTC holdings, and the attacker has been spending them in that order. The first major exit came on September 2, when the largest vault’s 20.50 BTC was routed through THORChain into Ethereum, adding transaction layers that make funds harder to follow.
Two Ethereum addresses that received the funds have since been emptied. The attacker then shifted to CoinJoin, which mixes multiple users’ Bitcoin inputs and outputs, making individual funds harder to trace.
About 15.48 BTC was moved on September 5, followed by a 61.12 BTC move on September 6, with some funds entering CoinJoin rounds through intermediate addresses. Across three major movements, the attacker moved 97.09 BTC in five days, leaving approximately 116.98 BTC untouched in the Wave 3 vaults.
This means roughly 45% of the 214.07 BTC in these vaults has already been moved. Researchers also identified a previously unknown vault containing funds from 58 addresses with the same 2-of-2 multisig pattern, later linked to CoinJoin.
If confirmed as another Coldcard victim vault, Wave 3 would rise from 293 to 294 vaults, potentially increasing the estimated total stolen to around 1,806 BTC. Galaxy Research reported, “Approximately 82% of coins stolen in the Coldcard exploit remain held in the original attacker-controlled addresses, while 18% has been moved apparently for laundering purposes.”
