THORChain Trickery: Coldcard Hacker Moves 45% of Stolen Bitcoin

• The hacker involved in Coldcard’s third wave has transferred nearly 45% of the stolen Bitcoin using THORChain and CoinJoin methods.
• As reported by Galaxy, a significant 82% of the Bitcoin taken during the Coldcard hacks remains with the attackers.

The individual behind the latest Coldcard wallet breach has intensified the transfer of stolen funds, according to Galaxy Research. They have moved about 45% of the Bitcoin acquired in this latest wave, employing techniques that complicate blockchain tracing.

On September 2, the hacker transferred Bitcoin to Ethereum using THORChain, and recent movements have included utilizing CoinJoin rounds. CoinJoin aggregates several users’ transactions into a single one, making it challenging to trace individual transfers on the Bitcoin blockchain. This method sheds light on the hacker’s tactics for managing the stolen assets.

Two-of-Two Multisignature Vaults Reflect an Attack Strategy

As per Galaxy, the third wave of the hack involved the creation of 293 two-of-two multisignature vaults, containing the Bitcoin taken from victims. The funds have been systematically transferred from the largest vaults, moving in descending order of their amounts. Researchers from Galaxy noted that Bitcoin from the 11 most substantial vaults has already been moved.

This led experts to identify some of the transactions associated with the breach. They uncovered an unfamiliar multisignature vault likely used for the transfer of stolen Bitcoin from another victim. However, Galaxy could not ascertain the details regarding this fresh theft, signaling potential expansions of the attack, though no new confirmed losses have been reported to date.

Majority of Stolen Bitcoin Remains Untouched

Despite recent developments, a significant portion of the Bitcoin stolen in the Coldcard attack waves is still contained within the originally attacked addresses. Galaxy indicates that 82% of the Bitcoin siphoned off during these attacks remains in the hands of the hackers. The other 18% has been transferred in ways that suggest laundering activities.

Thus, the third wave accounts for a considerable share of ongoing fund movement, providing investigators with another approach to monitor transactions. The Coldcard incident ranks as one of the largest cryptocurrency breaches recorded in 2026. According to DefiLlama, this is the third-largest exploit of the year in terms of reported losses, trailing behind the Kelp DAO hack at approximately $293 million and the Drift Protocol exploit, which bears losses of around $280 million.

This incident illustrates how illicitly acquired cryptocurrency can be transferred across diverse blockchain systems such as THORChain and CoinJoin. These movements serve as crucial evidence for investigators and market participants striving to trace the stolen assets.

Trending Crypto Updates:
Hanwha of South Korea Promotes Tokenized Securities Using the Avalanche Platform Amid Regulatory Changes