Coldcard exploiter moves stolen Bitcoin as total theft nears $144 million
Security & Exploits ·
Attacker linked to the Coldcard hardware wallet exploit has begun laundering funds through THORChain and CoinJoin mixing, with Galaxy Research tracking roughly 1,806 BTC stolen, worth about $143.9 million.
Galaxy's figures put the cumulative theft at 1,806 BTC across the exploit's multiple waves, with 82% of the stolen funds still sitting in attacker-controlled addresses. A separate tally from Galaxy Research, cited by The Block, put an earlier snapshot of the theft at 1,779 BTC stolen from 190 victims, suggesting the total has grown as researchers continue to trace additional wallets tied to the exploit.
The laundering activity centers on what researchers describe as "wave 3" of the attack. According to Decrypt, the exploiter moved $7.7 million of stolen Bitcoin by systematically draining 293 separate vaults, representing nearly half of the third wave's haul. CryptoPotato reports that 45% of the wave 3 loot has now entered CoinJoin mixing services after passing through THORChain, a pattern consistent with an attempt to obscure the funds' origin before further movement.
The mechanics of the theft point to a compromise affecting Coldcard hardware wallets, though the provided material does not detail the specific vulnerability exploited or confirm how attackers gained access to victim funds across the reported 190 victims. What is established is the scale of movement: draining hundreds of individual vaults in a systematic fashion, then routing a significant share of proceeds through cross-chain and mixing infrastructure designed to break the on-chain trail.
The fact that 82% of the total stolen amount remains in attacker-controlled addresses indicates the laundering effort is still in its early stages relative to the full scope of the theft. Four distinct sources have now corroborated elements of this event, from the initial theft tally to the wave-by-wave laundering mechanics, though full attribution of the exploit and any recovery efforts have not been detailed in the available reporting.
Unresolved questions include the exact method attackers used to compromise the affected wallets, whether any funds have been frozen or recovered, and how much of the remaining 82% will eventually move through similar laundering channels. Researchers are expected to continue tracking the flow of funds through THORChain and CoinJoin services as additional waves of the exploit are analyzed.