Coldcard Hacker Moves 45% of Wave 3 Bitcoin Loot

The attacker behind the third wave of Coldcard wallet exploits has started moving a large portion of the stolen funds. Analysts at Galaxy Research report that about 45 percent of the loot from Wave 3 has been transferred. The hacker is using THORChain to swap assets to Ethereum and routing transactions through CoinJoin privacy tools to cover their tracks.

The activity began in September, with the attacker systematically moving the largest stolen amounts first. While the biggest wallets have already emptied, many smaller vaults still hold active balances. Galaxy Research also uncovered a previously unknown vault connected to dozens of addresses belonging to affected victims.

Despite these large movements, most stolen funds remain sitting in attacker addresses. Around 82 percent of all stolen coins across every wave are still untouched. The original exploit targeted a long standing firmware flaw that weakened private keys, though the broader crypto market brushed off the news as Bitcoin prices held strong near $79,500.