Odaily Planet Daily reports that the attacker in the Coldcard "Wave 3" incident continues to move the stolen funds. During this phase, the attacker created 293 separate 2-of-2 multisignature vaults for each victim. On September 2, the first batch of funds was cross-chain transferred to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.
Currently, Wave 3 attackers are processing the largest funds in order of stolen amounts, having already transferred wallets ranked 1 through 11. The next 10 wallets yet to be moved hold a combined total of 30.81 BTC, while wallets ranked 61 through 293 hold a combined total of 33.77 BTC.
To date, the attacker has transferred approximately 45% of the stolen assets from this exploit, with funds moving to Ethereum or entering CoinJoin mixing transactions. This fund transfer also revealed a previously unknown vault: 58 addresses collectively spend via a 2-of-2 multisignature scheme in the same format as Wave 3, with further transfers from the Wave 3 attackers to a jump address funding CoinJoin.
This vault is currently marked as "cause = open," but it is likely also among the Coldcard victims, which could increase the total number of vaults involved in Wave 3 to 294 and raise the previously reported total BTC stolen due to the Coldcard vulnerability to approximately 1,806 BTC.