The shady hacker tied to wave 3 of those Coldcard raids just shifted 45% of the snatched BTC already 😈🖤.
Wave 3 Haul 🌑
Galaxy Research spilled that the loot got routed thru THORChain straight into ETH or dropped into Coinjoin mixers for some sneaky laundering 💀. During this round the exploiter whipped up 293 fresh 2-of-2 multisig vaults holding victim coins. First moves on September 2 funneled everything via THORChain to Ethereum but lately it’s all about Coinjoin rounds fr.
Galaxy Research just shared the latest on the Coldcard heist movements
— Galaxy Research (@glxyresearch) tweet link
They’ve been clearing the biggest chunks first so ranks 1 thru 11 are already cleaned out rn. The next ten untouched vaults still hold 30.81 BTC while ranks 61 to 293 sit on 33.77 combined. Fresh txs helped spot a mystery vault linked to 58 addresses probably from more Coldcard victims 👀.
Aftermath Vibes 🦇
Most of the stolen satoshis across every wave are still chilling in the attacker’s wallets with around 82% unmoved tho. Only 18% got laundered so far lmao. The whole mess kicked off July 30 2026 after a firmware bug from March 2021 let weak random generators replace proper hardware entropy dropping seed security to like 40 bits on older kits. Attackers brute forced keys without ever touching the hardware itself.
BTC activity spiked hard post exploit as holders scrambled to move and consolidate funds pushing active addresses to an eight month high. Price barely flinched tho and BTC actually rallied toward $82,000 last month before cooling to $79,500 rn ✨.
Just another echo from the void by iconofsin.eth 💖
