Coldcard hacker moves 45% of stolen BTC via THORChain
Galaxy Research reported about 45% of Bitcoin stolen in Coldcard’s third-wave hack was routed through THORChain to Ethereum and into CoinJoin rounds; transfers began Sept. 2.
The exploiter behind the third wave of the Coldcard wallet hack moved about 45% of the stolen Bitcoin, routing funds through THORChain and into CoinJoin transactions, Galaxy Research reported. Activity began on Sept. 2 when Bitcoin was sent to Ethereum via the THORChain cross-chain service.
THORChain is a protocol that enables swaps between different blockchains. CoinJoin transactions combine multiple users’ Bitcoin payments into a single transaction, which makes on-chain links between sender and recipient harder to trace.
Galaxy Research’s analysis identified 293 two-of-two multisignature vaults used to hold victims’ coins. The exploiter has been emptying those vaults in descending order of size, starting with the largest holdings. Funds from the 11 largest vaults in that cluster have been moved.
Tracing the transfers revealed an additional vault that likely contained another victim’s funds; the firm noted the cause of that specific loss has not been confirmed.
Across all waves of the Coldcard exploit, about 82% of the stolen Bitcoin remains in attacker-controlled addresses, while roughly 18% has been shifted to other chains or into mixing services, Galaxy Research reported.
By value, the Coldcard incident ranks as the third-largest exploit recorded so far in 2026. Blockchain data aggregator DefiLlama places it behind a $293 million breach of Kelp DAO and a $280 million hack of the Drift protocol.
Security trackers are monitoring the pattern of withdrawals and the order in which vaults are emptied. Galaxy Research is continuing to follow the transactions and will update its traceability assessments as funds move.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
