Coldcard hack attacker moves 45% of stolen Bitcoin
Attacker shifts nearly half of stolen Bitcoin
On Sep 7, 2026, Galaxy Research reported that the individual behind the third wave of the Coldcard hardware‑wallet hack moved roughly 45 % of the Bitcoin they stole. The funds were sent through the THORChain bridge to Ethereum and later mixed in CoinJoin transactions, a method that combines many payments to hide origins.
Main details
- The attacker created 293 two‑of‑two multisignature vaults to store victims’ coins.
- Funds were taken from the 11 largest vaults, moving from biggest to smaller.
- The first movement to Ethereum via THORChain occurred on Sep 2.
- CoinJoin rounds were used to further obscure the Bitcoin trail.
- Across all Coldcard attack waves, 82 % of stolen Bitcoin stays in the original attacker‑controlled addresses; 18 % has been moved, appearing to be laundering.
What is confirmed
Galaxy Research’s analysis confirms that the third‑wave exploiter moved about 45 % of the stolen Bitcoin, that the movement began on Sep 2 through THORChain, and that CoinJoin transactions were later employed. The research also identifies 293 two‑of‑two vaults, with the 11 largest already emptied.
Open questions
The cause of loss for a newly identified vault remains unconfirmed, and further movements of the remaining Bitcoin have not yet been observed.
Impact on crypto security
The activity demonstrates how stolen funds can be transferred across blockchains and mixed to evade detection, highlighting the importance of securing hardware wallets and monitoring cross‑chain bridges for illicit activity.
Next steps
Galaxy Research will continue to track the remaining Bitcoin and any additional laundering attempts.
