Coldcard ‘Wave 3’ attacker moves Bitcoin again: ‘Moved apparently for laundering purposes’

More than a month has passed since the Coldcard exploit happened, but the attacker has not stopped moving funds yet.

On the 7th of September, Galaxy Research came up with an analysis that showed that the Coldcard “Wave 3” attacker is actively moving the stolen Bitcoin [BTC] through different transaction paths.

The laundering route of the exploiter

According to the on-chain activity, the attacker first moved the stolen funds through THORChain into Ethereum [ETH]. And now the laundering is happening through Bitcoin CoinJoin transactions.

Here, in Wave 3, the attacker appears to have created 293 separate 2-of-2 multisig vaults, with each vault corresponding to a victim or group of victim funds.

According to the analysis, about 208.24 BTC was consolidated from roughly 1,912 victim addresses into 293 collection addresses. Post which, each collection address then funded one of these vaults. This effectively created a structured system for storing the stolen BTC.

Bitcoin’s compromised so far

Going ahead, the 293 vaults were then ranked according to how much BTC they originally contained, and the attacker has been spending them in that order.

The first major exit came on 2nd September, when the largest vault’s 20.50 BTC was routed through THORChain into Ethereum, adding more transaction layers and making the funds harder to follow. Two Ethereum addresses receiving the funds have since been emptied.

The attacker then shifted to CoinJoin, which mixes multiple users’ Bitcoin inputs and outputs, making individual funds harder to trace. Using the latter, about 15.48 BTC was moved on 5th September.

This was followed by a 61.12 BTC move on 6th September, with some funds entering CoinJoin rounds through intermediate addresses.

That said, across three major movements, the attacker was able to move 97.09 BTC in five days, leaving about 116.98 BTC untouched in the Wave 3 vaults.

This means roughly 45% of the 214.07 BTC in these vaults has already been moved.

Laundering appears to continue further

Researchers also identified a previously unknown vault containing funds from 58 addresses that showed the same 2-of-2 multisig pattern and was later linked to a CoinJoin.

If confirmed as another Coldcard victim vault, Wave 3 would rise from 293 to 294 vaults. This in turn would potentially increase the estimated total stolen to around 1,806 BTC.

After all of these movements, Galaxy Research reported,

Approximately 82% of coins stolen in the Coldcard exploit remain held in the original attacker- controlled addresses, while 18% has been moved apparently for laundering purposes.

Final Summary

• The Coldcard exploiter has now moved the stolen funds through Bitcoin CoinJoin transactions.
• Around 82% of coins stolen in the Coldcard exploit remain held in the original attacker-controlled addresses.