Coldcard Attacker Moves $7.7M in Stolen Bitcoin via THORChain, CoinJoin

Scope of the Third-Wave Theft

The Coldcard attacker has drained 11 of the largest vaults compromised in the third wave of thefts, moving $7.7 million in Bitcoin, Galaxy Research reported. This represents 45% of the total Bitcoin stolen in that attack phase, according to the firm's analysis. According to Decrypt, the attacker built 293 separate vaults to hold the stolen funds and is emptying them in order of size, largest first.

Use of Mixing Services

The attacker routed the stolen funds through THORChain and CoinJoin, two services commonly used to obscure transaction trails and break the on-chain link between the theft source and final recipient addresses. The choice of mixing services suggests the attacker is attempting to impede traceability by law enforcement and blockchain analysts, though Galaxy Research did not comment on the effectiveness of the obfuscation.

Broader Security Implications

The incident underscores recurring vulnerabilities in hardware wallet security and the risks posed by supply-chain or firmware compromises. Coldcard's parent company has not issued a public statement on the scope of the breach or remediation steps since the third wave began. The repeated targeting of Coldcard users across multiple attack cycles suggests the attacker either retains access to a list of users or continues exploiting a known vector that has not been publicly patched. The systematic vault construction and structured liquidation strategy indicates a deliberate, well-resourced operation rather than opportunistic theft.