Galaxy Research: Coldcard Attackers Continue Transferring Stolen Funds, 45% Moved to Mixing or Cross-Chain Services

ChainCatcher reports that, according to Galaxy Research, the attackers behind the Coldcard "Wave 3" incident continue to move stolen funds. During this phase, the attackers created 293 separate 2-of-2 multisignature wallets for each victim. The initial funds were bridged to Ethereum via THORChain; the latest transfers have begun entering CoinJoin mixing processes. Currently, the Wave 3 attackers are processing wallets in descending order of stolen amounts, having already moved wallets ranked 1 through 11. The next 10 wallets yet to be moved collectively hold 30.81 BTC, while wallets ranked 61 through 293 hold a combined total of 33.77 BTC. To date, the attackers have moved approximately 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or into CoinJoin mixing transactions. Additionally, chain analysis teams have identified a previously unknown wallet: 58 addresses collectively spend using the same 2-of-2 multisignature format as Wave 3, with funds subsequently transferred by the Wave 3 attackers to a jump address funding CoinJoin. The chain analysis team has labeled this wallet as "cause = open," but believes it likely also belongs to a Coldcard victim—suggesting the total number of affected wallets may rise to 294 and pushing the estimated total stolen from the Coldcard vulnerability to approximately 1,806 BTC. Currently, about 82% of the stolen BTC remains in the addresses originally controlled by the attackers, while approximately 18% has been moved, with fund flows indicating possible money laundering activity.