More than a month after the Coldcard exploit, the attacker continues to move stolen funds. According to Galaxy Research analysis published on September 7th, approximately 208.24 BTC were consolidated from around 1,912 victim addresses into 293 2-of-2 multisig vaults. Between September 2nd and 6th, the attacker moved 97.09 BTC via THORChain into Ethereum and CoinJoin transactions, representing roughly 45% of the 214.07 BTC held in these vaults. To date, 82% of the stolen coins remain held in attacker-controlled addresses, while 18% has been moved for apparent laundering purposes.
Source: Read the original article
