The attacker isn't panicking, they're methodical — draining the 11 largest vaults first and laundering just enough to avoid triggering the full alarm.
The Summary
- The Coldcard exploiter moved 45% of Bitcoin stolen in the third attack wave, approximately $7.7 million in BTC, through THORChain and CoinJoin mixers according to Galaxy Research
- Galaxy identified roughly 1,779 BTC stolen from 190 victims across more than 8,600 addresses as of mid-August, with the attacker now systematically draining the largest vaults
- 82% of Bitcoin stolen across all Coldcard attacks remains in original addresses, suggesting either patience or operational challenges in laundering at scale
- The targeted liquidation of Wave 3's biggest holdings reveals a calculated approach, not desperation
The Signal
The attacker drained the 11 largest vaults tied to the third wave of Coldcard thefts, moving 45% of funds stolen specifically from that attack phase. This isn't scattershot panic. It's triage. Go after the biggest pools first, move methodically, avoid patterns that trigger automated flags. Galaxy Research tracked the movement through THORChain and CoinJoin, two tools designed to obscure blockchain trails through decentralized swaps and transaction mixing.
The numbers tell a story about operational constraints. 1,779 BTC stolen from 190 victims spread across 8,600+ addresses. That's a distribution nightmare if you're trying to cash out. You can't move it all at once without every chain analysis firm on earth lighting up their dashboards. So you move 18% total, 45% from one wave, and you leave 82% sitting cold.
"82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses."
Why? Three possibilities:
- Operational bottleneck: Laundering takes time, infrastructure, and counterparties willing to touch hot coins
- Strategic patience: Better to wait months or years than trigger coordinated exchange freezes now
- Multiple actors: Different waves, different operators, different levels of sophistication
The Coldcard attacks revealed something uncomfortable about hardware wallet security. These weren't phishing victims or browser extension exploits. The vulnerabilities targeted the supply chain and firmware, the parts of the stack users assume are bulletproof. You bought the hardware wallet specifically to avoid getting rekt. And here we are.
Galaxy's tracking matters because it establishes baseline behavior. If 18% moved is the pattern, exchanges and OTC desks now have a profile. Watch for THORChain volume spikes. Watch for CoinJoin clusters with this specific UTXO signature. The attacker just gave up operational security for liquidity. That trade gets harder to make as the percentage moved climbs.
The Implication
For anyone holding serious Bitcoin, this is a reminder that "not your keys, not your coins" has a corollary: "your keys, your security model." Hardware wallets are better than exchanges for custody, but they're not magic. Firmware updates matter. Supply chain verification matters. If you're holding life-changing money on a single device from a single vendor, you're not diversified where it counts.
For the industry, this is a test case for on-chain forensics at scale. Can Galaxy, Chainalysis, and exchanges coordinate fast enough to freeze the remaining 82% before it moves? Or do we watch it trickle out over the next 18 months, 5% at a time, through an evolving playbook of mixers and swaps? The answer shapes how seriously institutions take self-custody in 2027.