Bitcoin
Coldcard Hacker Reroutes 97 BTC from Third Attack Wave via Privacy Tools
On-chain tracking indicates an attacker moved 97.09 BTC taken in the Coldcard breach using THORChain and CoinJoin, though the vast majority of stolen funds remains untouched.
The entity behind the third wave of Coldcard thefts moved 97.09 BTC between September 2 and September 6, accounting for roughly 45% of the assets taken during that specific phase. On-chain data reported by CoinDesk shows the attacker transferred approximately 20.5 BTC into Ethereum via THORChain on September 2, before funneling 15.48 BTC into CoinJoin transactions on September 5 and routing an additional 61.12 BTC from 10 vaults on September 6.
According to research from Galaxy Research published by The Block, the transfers originated from a concentrated set of wallets. The attacker completely drained the 11 largest vaults out of 293 associated with Wave 3. In contrast, the next 10 largest vaults hold 30.81 BTC, while the remaining 233 wallets hold a cumulative total of 33.77 BTC, leaving the majority of smaller addresses unemptied.
The broader theft across all Coldcard attack waves is estimated at approximately 1,806 BTC, representing a total value of around $143.9 million. This calculation includes an additional vault funded by 58 addresses. Galaxy Research noted that despite the recent movements from Wave 3, roughly 82% of the total stolen funds remains static in attacker-controlled addresses.
These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.
More on Bitcoin All pieces →
- Neutral Block Files for US National Trust Bank Charter to Consolidate Crypto Custody
- Neutral Tokenized Asset Holders Cross 3.5 Million as Institutional Inflows Rebound
- Neutral Iran Eases Currency Restrictions to Permit Cross-Border Crypto Settlements
- Neutral Block Seeks OCC Approval for Builders Bank & Trust to Manage Digital Assets
Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.
