Galaxy Research Says Coldcard Wave 3 Attacker Continues Moving Stolen Funds

Galaxy Research said the attacker behind Coldcard's Wave 3 incident is still moving stolen funds. The attacker created 293 separate 2-of-2 multisig vaults for victims' assets during this phase, with the first transfers bridged to Ethereum through THORChain and the latest transfers beginning to enter CoinJoin mixing. According to ChainCatcher, the attacker has now moved the largest vaults in descending order of stolen amount, transferring vaults ranked 1 through 11. The next 10 vaults yet to be moved hold a combined 30.81 BTC, while vaults ranked 61 through 293 hold 33.77 BTC in total. Galaxy Research said about 45% of the stolen assets from the exploit have been moved so far, with funds flowing either to Ethereum via THORChain or into CoinJoin transactions. It also identified a previously unknown vault involving 58 addresses that jointly spent funds in the same 2-of-2 multisig format used in Wave 3, before the attacker routed the funds to a jump address used to fund CoinJoin. The analysis team currently labels that vault as cause = open, but said it is likely also tied to a Coldcard victim. If confirmed, the number of vaults involved in Wave 3 would rise to 294, and the previously disclosed total stolen amount would increase to about 1,806 BTC. Galaxy Research added that about 82% of the stolen BTC remains in the attacker's original addresses, while about 18% has been moved, suggesting possible laundering activity.