Coldcard hackers move 45% of stolen Bitcoin via THORChain

Coldcard Wave 3 attackers moved 45% of stolen Bitcoin via THORChain and CoinJoin. 82% of the assets remain in attacker-controlled addresses.

Attackers behind the Coldcard hardware wallet Wave 3 breach have moved about 45% of the stolen Bitcoin, according to multiple reports citing Galaxy Research. The stolen funds were routed through THORChain, a cross-chain swap protocol, and CoinJoin, a privacy technique that mixes transactions to obscure fund flows. The attackers created 293 two-of-two multisig vaults for victims’ assets, emptying the largest vaults first. The 11 largest vaults have already been moved. So far, approximately 97.09 BTC, valued at $7.8 million, has been spent. Galaxy Research estimates that 82% of all stolen Coldcard funds remain in attacker-controlled addresses, while 18% has been moved, likely in attempts to launder the assets. The thefts stem from a 2021 firmware bug that weakened seed generation, allowing attackers to brute-force private seed phrases. A newly identified vault could increase total losses to about 1,806 BTC. There is mention of a possible Wave 4, but it remains unconfirmed.