Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Across all attack waves, 82% of stolen coins remain in attacker-controlled addresses, while 18% have been moved for laundering.
ByChayanika Deka
The exploiter linked to the third wave of attacks on Coldcard wallets has now moved 45% of the coins stolen
The firm said the funds have been transferred either to Ethereum through THORChain or into Coinjoin, in an effort to launder the stolen assets. During Wave 3, the exploiter created 293 2-of-2 multisig vaults for victims’ coins.
Wave 3 Haul
The first movements on September 2 sent funds through THORChain to Ethereum, while the latest activity has moved into Coinjoin rounds. Galaxy Research <a href="https://x.com/glxyresearch/status/2096785369043784085" rel="nofollow noopener" target=”_blank”>said the operator has been systematically spending the largest share of the thefts according to their size ranking. Ranks 1 through 11 have already been moved.
The next 10 unmoved vaults contain 30.81 BTC, while ranks 61 through 293 hold a combined 33.77 units. The latest transactions led Galaxy to identify a previously unknown vault linked to 58 addresses that are likely associated with Coldcard victims.
Most of the funds stolen in the Coldcard exploit have yet to move. In fact, approximately 82%, across all waves, are still held in the attacker-controlled addresses where the coins were initially stored. The remaining 18% has already been moved, and the transfers are apparently linked to efforts to launder the exploit’s haul.
Aftermath
The attack began on July 30, 2026, and targeted Coldcard wallets with a firmware flaw that had existed for years. The issue came from a March 2021 update and a build error. It made wallets use a weak software random generator instead of their hardware-basedas low as 40 bits on older devices. Attackers could then brute-force the keys without physically accessing the wallets
<a href="https://xpertsstudio.com/bitcoin-chips-away-at-weekend-upside-as-80k-hangs-in-the-balance/” title=”Bitcoin chips away at weekend upside as $80K hangs in the balance”>Bitcoin activity jumped sharply after the exploit as affected users moved and consolidated their holdings to limit exposure, pushing active addresses to an eight-month high. But the incident had negligible impact on the price of the crypto asset. Instead, BTC posted an impressive rally, nearing $82,000 last month.
Source: cryptopotato.com