Crypto07 September, 20262 min read
Coldcard Wave 3 Exploiter Moves 45% of Stolen Bitcoin via THORChain and CoinJoin
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Wave 3 exploiter moved about 97.09 BTC (~$7.8M) via THORChain and CoinJoin. 82% of all Coldcard stolen BTC remains in original addresses.
6 outlets told this the same way.
Wave 3 Funds Moved
Galaxy Research said the Coldcard Wave 3 exploiter has moved 45% of the stolen funds, with the firm reporting that by mid-August it had identified roughly 1,779 BTC stolen from 190 victims and more than 8,600 addresses. The thefts began on July 30 and stemmed from a firmware bug that Coinkite shipped back in 2021, which affected how Coldcard devices generated wallet seeds and reduced the randomness used to create them. The Block reported that the attacker has been moving the stolen coins in size order, largest first, and that ranks 1-11 are already moved while the next 10 untouched vaults hold 30.81 BTC.
Galaxy said the operator created 293 separate 2-of-2 multisignature vaults, with each holding wallet requiring signatures from two of two designated keys to spend. The Crypto Times added that the Wave 3 operator has been methodically moving the largest thefts in order by size rank, and that spent proceeds have gone either to Ethereum via THORChain or into CoinJoin denominations.
THORChain and CoinJoin
Galaxy Research said the latest activity involved CoinJoin transactions on Sunday, after an earlier move on Sept. 2 in which the exploiter swapped stolen Bitcoin into Ethereum through THORChain.
The Crypto Basic reported that Galaxy’s analysis showed the operator continues to move the stolen coins, including vaults ranked 1 through 11 already moved and a combined 30.81 BTC in the next 10 untouched vaults.
In a Monday update, Galaxy said the exploiter began moving funds to Ethereum through THORChain on Sept. 2, and that by September 5 and 6 additional portions had been run through CoinJoin transactions.
Crypto Briefing described the cash-out as routing approximately 97.09 BTC, worth about $7.8 million, through cross-chain swaps and mixing services over a five-day window.
The Crypto Times said Galaxy posted the Sept. 7 update on X at 02:19 UTC on September 7, 2026, timestamped to Bitcoin block 965,863, as part of an on-chain update about the Wave 3 operator’s cash-outs.
Remaining Funds at Risk
Across the overall exploit, Galaxy said 82% of the stolen funds remain in the original attacker-controlled addresses, while the rest has been moved for laundering purposes.
The Block reported that in terms of total funds exploited out of Coldcard devices, 82% remains in the original attacker-controlled addresses, while the rest has been moved for laundering purposes.
Crypto Briefing said the full scope includes 1,789 BTC across 8,865 addresses, and that an additional cluster of 58 addresses could push total losses to roughly 1,806 BTC.
The Block said counting a previously unknown vault consisting of 58 addresses would bring the total losses to 1,806 BTC, which it valued at $143.9 million at current prices.
The Crypto Times noted that the Sept. 7 update follows the first confirmed cash-out from any of Waves 1, 2, or 3, and that on Sept. 2 Galaxy Research head Alex Thorn reported Wave 3 coins had left original attacker addresses and been swapped to ether over THORChain.