Coldcard Attacker Moves 45% of Stolen Bitcoin

The perpetrator behind the Coldcard hardware wallet exploits has significantly escalated the movement of stolen funds, transferring approximately 45% of Bitcoin stolen during the third wave of attacks. This activity, tracked by Galaxy Research, involves approximately 97.09 Bitcoin, valued at around $7.8 million, and employs methods designed to obscure the trail of the illicit assets. The attacker began moving funds on September 2, routing Bitcoin through the THORChain protocol and swapping it for Ether, with proceeds appearing on the Ethereum blockchain. More recently, starting Sunday, September 6, the exploiter has utilized CoinJoin transactions. CoinJoin is a privacy-enhancing technique that mixes Bitcoin transactions from multiple users, making it substantially more difficult for investigators to trace individual fund flows on the Bitcoin blockchain. According to Galaxy Research, the attacker has structured the fund transfers by emptying the largest vaults first. In the third wave, 293 two-of-two multisignature vaults were created to hold victims' coins. The 11 largest vaults have now been emptied, with subsequent movements targeting smaller vaults.