Coldcard exploiter moves about 45% of Wave 3 bitcoin through mixers and THORChain
Galaxy Research says the operator behind the third wave of the Coldcard wallet exploit has moved nearly half of the bitcoin tied to that wave, complicating recovery and attribution.
By The Third AnglePublished 4 min read
Onchain movement can complicate recovery without proving that funds were liquidated. Photo: Unsplash · Unsplash License
Nearly half of Wave 3 funds moved
The operator behind the third wave of the Coldcard hardware-wallet exploit has moved about 45% of the bitcoin attributed to that wave, according to Galaxy Research. The Block reported that the funds were routed through THORChain or CoinJoin transactions, two paths that can make direct tracing and recovery more difficult.
Cointelegraph independently described the same development, citing Galaxy’s tracking of the exploiter’s haul and the movement of coins into cross-chain swaps and mixing transactions. The figures are blockchain-analysis estimates, not a court finding or a statement from the attacker.
The key distinction is movement is not proof of cash-out. Bitcoin can be consolidated, swapped, mixed or parked without establishing that the operator sold it for fiat. The transactions do show an active effort to change the funds’ path and ownership signals.
Why the trail matters
The Coldcard incident traces back to a weak-randomness issue affecting some older wallet-generation workflows. Researchers and security teams have linked multiple waves of addresses to the flaw, but the total loss estimate remains subject to attribution and new discoveries.
Cross-chain routing adds another layer of uncertainty. THORChain can swap native assets between networks, while CoinJoin transactions combine inputs and outputs in ways that obscure simple address-based narratives. Neither tool proves wrongdoing by the protocol itself; the relevant fact is how the suspected exploiter used the routes after the theft.
Galaxy’s estimate that 45% of Wave 3 funds moved does not mean 45% of all Coldcard losses moved. Scope matters: Wave 3 is one cluster in a broader investigation, and estimates can change as analysts identify more victims, false positives or related addresses.
For affected users and investigators, the useful evidence is the transaction graph, not a headline percentage. Watch for deposits at identifiable exchanges, bridge endpoints, sanctions-screened services or addresses tied to prior waves. Until assets are frozen or returned, the public ledger can show movement without showing who ultimately controls the coins.
The update reinforces a broader security lesson: once a hardware-wallet seed is generated with compromised entropy, moving funds to a fresh, independently generated wallet is more important than merely updating the device. Readers should rely on Coldcard’s current security guidance and incident notices for remediation details rather than treating onchain movement as proof that the threat has ended.
