Crypto attacker moves 45% of stolen Bitcoin, draining 11 largest vaults in third Coldcard wave
Galaxy Research reports the third-wave hacker has moved approximately $7.7 million in Bitcoin through THORChain and CoinJoin to obscure traces.
The hacker behind the latest Coldcard wallet breach has drained funds from the eleven largest storage vaults, moving roughly 45% of the stolen cryptocurrency, Galaxy Research stated. Since September 2, the attacker routed Bitcoin through Ethereum using THORChain and initiated transactions via CoinJoin to evade tracking. This action involved shifting coins from vaults in descending order of size, totaling approximately $7.7 million moved so far. Funds from these locations were intended to create a single transaction pool to hide origins. Approximately 82% of all stolen Bitcoin remains trapped in addresses controlled by the attacker across every wave of the hack, while only 18% has been relocated for suspected laundering efforts. The third-wave exploit is now ranked as the third-largest hack of 2026 by total value behind the $293 million Kelp DAO incident and the $280 million Drift protocol compromise.
