.jpg)
The Coldcard hacker is cashing out, and the laundering route is a masterclass in avoiding chokepoints. Galaxy Research says the exploiter behind the third wave of the Coldcard hardware wallet breaches has moved roughly 45% of stolen funds after weeks of dormancy, pushing 97.09 BTC, about $7.72 million at $79,500, into CoinJoin mixing transactions to blur the trail. The wave's total haul: approximately 1,779 BTC across 190 victim wallets and over 8,600 associated addresses, with cumulative losses across all Coldcard waves standing near $111 million.
"The Coldcard Wave 3 hacker has moved stolen Bitcoin into Ethereum via THORChain... The wave 3 exploiter has moved stolen funds into CoinJoin privacy transactions after previously swapping portions to ether." — Alex Thorn (@intangiblecoins), Galaxy Research
Why the Coldcard Attack Keeps Getting Worse
The context is what makes the movement notable. Wave 3 targeted 293 P2WSH-type Vault multisig addresses on Coldcard devices, exploiting a random number generator flaw in legacy firmware that let attackers derive private keys and run automated sweep scripts across victim addresses. The assumption multisig buyers paid for, that multiple compromised devices do not share one firmware flaw, died with this wave. On-chain data shows the attacker converted 6 BTC into 204.7 ETH via THORChain on Sept. 2, hopping to Ethereum before the recent Bitcoin moves, and roughly 970 BTC sits unspent in hacker-controlled vaults. Coinkite's advisory still stands: users on legacy firmware should upgrade and migrate funds to newly generated seed phrases immediately, the same migrate-everything posture security teams pushed after the Binance phishing waves and the Pocket Bitcoin data breach.
The laundering stack is the story beneath the story. CoinJoin plus THORChain means no centralized exchange ever touches the flow: mixing breaks the heuristics, the cross-chain hop changes the asset, and the exit liquidity lives in DeFi pools, exactly the off-ramp problem that US-UK enforcement pacts are nowhere near solving. Law enforcement's recovery odds drop with each hop, and Galaxy's public tracking, useful as it is, mostly documents the theft rather than stop it.
Watch the remaining 970 BTC. If it moves the same way, this becomes the template for liquidating hardware wallet thefts at scale, and the lesson hardens: single-vendor multisig is a single point of failure wearing three signatures.
