The Coldcard attacker has expanded their laundering operations beyond THORChain to include Bitcoin CoinJoin transactions, according to Galaxy Research's latest analysis. After moving approximately 10% of the stolen Bitcoin through THORChain on September 3, the attacker created 293 separate 2-of-2 multisig vaults with each vault corresponding to victim or group of victim funds. The laundering route now includes consolidating about 208.24 BTC from roughly 1,912 victim addresses into 293 collection addresses, followed by systematic spending from the highest-value vaults first. The attacker has moved 97.09 BTC in five days across three major movements, with the first major exit on September 2 when 20.50 BTC was routed through THORChain into Ethereum, followed by 15.48 BTC on September 5 and 61.12 BTC on September 6.
THORChain allows users to exchange native assets across blockchains without depositing funds into a centralized exchange, converting native Bitcoin into Ether without relying on conventional custodial platforms. However, not every transaction succeeded as the hacker experienced technical problems while attempting to process the swaps. As reported by Galaxy Research, the hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying. The cause of the refunds was not immediately confirmed, with possible explanations including liquidity limitations, transaction settings or protocol safeguards, though no verified technical assessment had established the reason.
Galaxy Research previously attributed the loss of 1,789.28 BTC across 8,865 addresses to the Coldcard vulnerability, with the Bitcoin worth approximately ₹9,000 crore when stolen. The Bitcoin was worth approximately $114.7 million when stolen, according to Galaxy Research. As crypto.news previously reported, approximately 87% of the identified Bitcoin remained unmoved as of August 25. The estimate included funds linked to multiple attackers and attack waves, not only the wallet now using THORChain. Galaxy's figures partly relied on 221 victim reports covering 790.72 BTC, with onchain analysis identifying additional affected addresses beyond those reported directly by customers.
The theft was linked to weak seed generation in Coldcard firmware released from 2021, with the vulnerability reducing the randomness protecting some wallet credentials, allowing attackers to calculate private keys without physically accessing the devices. Coinkite, Coldcard's manufacturer, says corrected firmware is available across affected models, but its current security guidance states that previously generated vulnerable seeds still require migration. Users must generate a new seed with corrected firmware and transfer their Bitcoin to addresses controlled by that new wallet, as installing updated firmware does not repair a seed created under the affected software. The incident has also prompted closer examination of how hardware wallets generate recovery phrases, with the exposed seeds containing insufficient randomness allowing attackers to derive keys remotely.
Researchers identified a previously unknown vault containing funds from 58 addresses that showed the same 2-of-2 multisig pattern and was later linked to a CoinJoin transaction, potentially increasing the total number of vaults from 293 to 294. If confirmed as another Coldcard victim vault, this would potentially increase the estimated total stolen to around 1,806 BTC. The attacker remains active with approximately 82% of coins stolen still held in original attacker-controlled addresses, while 18% has been moved apparently for laundering purposes. The laundering operations continue through structured systems where vaults are ranked by original BTC amounts and spent in order, with researchers monitoring whether the resulting ETH moves to centralized exchanges, bridges or privacy services.
