The hacker behind the third wave of Coldcard wallet attacks has moved approximately 45% of their Bitcoin haul, according to Galaxy Research. The exploiter began transferring funds to Ethereum through THORChain on Sept. 2 and used CoinJoin transactions to obscure the trail. They created 293 two-of-two multisignature vaults to store victims’ coins, draining the largest vaults first. Across all Coldcard attacks, 82% of stolen Bitcoin remains in the original attacker-controlled addresses, while 18% has been moved for apparent laundering. The Coldcard exploit ranks as the third-largest hack of 2026, behind the $293 million Kelp DAO hack and the $280 million Drift protocol hack.
Source: Read the original article
