Coldcard Wave 3 Attacker Continues Moving Stolen Funds Through CoinJoin and Ethereum

The attacker behind Coldcard’s Wave 3 incident is still transferring stolen funds, with the latest round moving assets into CoinJoin mixing. On September 2, the first funds were bridged to Ethereum through THORChain. According to Odaily, the attacker created 293 separate 2-of-2 multisig vaults for each victim’s assets during this phase and has now moved vaults ranked from No. 1 to No. 11 by stolen amount. The next 10 vaults yet to be moved hold a combined 30.81 BTC, while vaults ranked No. 61 to No. 293 hold 33.77 BTC. So far, about 45% of the stolen assets from the exploit have been transferred, with funds sent either to Ethereum or into CoinJoin transactions. The transfers also uncovered a previously unknown vault involving 58 addresses that jointly spent funds using the same 2-of-2 multisig format as Wave 3 and was later routed by the attacker to a jump address that funds CoinJoin. The vault is currently marked as “cause = open,” but it may also belong to a Coldcard victim. If confirmed, the number of vaults involved in Wave 3 would rise to 294, and the previously disclosed total stolen amount from the Coldcard exploit would increase to about 1,806 BTC.