Coldcard Exploiter Moves 45% of Wave 3 Loot as Stolen Bitcoin Enters CoinJoins

Across all attack waves, 82% of stolen coins remain in attacker-controlled addresses, while 18% have been moved for laundering.

The exploiter linked to the third wave of attacks on Coldcard wallets has now moved 45% of the coins stolen, according to Galaxy Research.

The firm said the funds have been transferred either to Ethereum through THORChain or into Coinjoin, in an effort to launder the stolen assets. During Wave 3, the exploiter created 293 2-of-2 multisig vaults for victims’ coins.

Wave 3 Haul

The first movements on September 2 sent funds through THORChain to Ethereum, while the latest activity has moved into Coinjoin rounds. Galaxy Research said the operator has been systematically spending the largest share of the thefts according to their size ranking. Ranks 1 through 11 have already been moved.

The next 10 unmoved vaults contain 30.81 BTC, while ranks 61 through 293 hold a combined 33.77 units. The latest transactions led Galaxy to identify a previously unknown vault linked to 58 addresses that are likely associated with Coldcard victims.

Most of the funds stolen in the Coldcard exploit have yet to move. In fact, approximately 82%, across all waves, are still held in the attacker-controlled addresses where the coins were initially stored. The remaining 18% has already been moved, and the transfers are apparently linked to efforts to launder the exploit’s haul.

Aftermath

The attack began on July 30, 2026, and targeted Coldcard wallets with a firmware flaw that had existed for years. The issue came from a March 2021 update and a build error. It made wallets use a weak software random generator instead of their hardware-based source. This weakened seed security from the expected 128 bits to as low as 40 bits on older devices. Attackers could then brute-force the keys without physically accessing the wallets.

Bitcoin activity jumped sharply after the exploit as affected users moved and consolidated their holdings to limit exposure, pushing active addresses to an eight-month high. But the incident had negligible impact on the price of the crypto asset. Instead, BTC posted an impressive rally, nearing $82,000 last month.

You may also like:

The asset has since pulled back but is trading near $79,500 at the time of writing.