Coldcard 'Wave 3' attacker moves Bitcoin again: 'Moved apparently for laundering purposes'
More than a month has passed since the Coldcard exploit happened, but the attacker has not stopped moving funds yet. On the 7th of September, Galaxy Research came up with an analysis that showed that the Coldcard “Wave 3” attacker is actively moving the stolen Bitcoin [BTC] through different transaction paths. The laundering route of the exploiter According to the on-chain activity, the attacker first moved the stolen funds through THORChain into Ethereum [ETH]. And now the laundering is happening through Bitcoin CoinJoin transactions. Source: Galaxy Research Here, in Wave 3, the attacker appears to have created 293 separate 2-of-2 multisig vaults, with each vault corresponding to a victim or group of victim funds. Discover more Brokerages & Day Trading Merchant Services & Payment Systems Astrology & Divination According to the analysis, about 208.24 BTC was consolidated from roughly 1,912 victim addresses into 293 collection addresses. Post which, each collection address then funded one of these vaults. This effectively created a structured system for storing the stolen BTC. Bitcoins compromised so far Going ahead, the 293 vaults were then ranked according to how much BTC they originally contained, and the attacker has been spending them in that order. Source: Galaxy Research The first major exit came on 2nd September, when the largest vaults 20.50









