The Hacker Behind the Coldcard Wallet Attack Just Started Laundering 45% of the Stolen Bitcoin — Here’s How He’s Hiding It

The attacker behind one of the biggest crypto thefts of 2026 has finally started moving the money. According to Galaxy Research, the exploiter behind the third wave of the Coldcard wallet hack has now moved roughly 45% of the stolen Bitcoin, routing funds through a cross-chain swap service and privacy tools in an apparent effort to cover the trail. For anyone who owns crypto, this story is a blunt reminder of where the real risks live — and why the phrase “not your keys, not your coins” cuts both ways.

By Marcus Johnson | September 7, 2026

The Hook: A Year-Long Heist Enters Its Cash-Out Phase

Here’s what happened, in plain English. Coldcard is a popular hardware wallet — a small physical device, a bit like a USB stick with a screen, that keeps your Bitcoin keys offline and away from hackers. Somewhere along the way, attackers found a way to compromise victims’ setups during the third wave of attacks targeting Coldcard users, and quietly siphoned their coins into attacker-controlled vaults.

For months, most of that stolen Bitcoin just sat still. That changed on September 2, when, per Galaxy Research’s Monday update, the exploiter began pushing funds into Ethereum via THORChain — a service that swaps one blockchain’s coins for another without needing a centralized exchange. Think of it as an airport currency-exchange booth that doesn’t ask for ID. From there, some of the Bitcoin was pushed through CoinJoin transactions, a privacy technique that blends many people’s payments into one big transaction so it becomes much harder to tell whose money is whose.

On-Chain Evidence: 293 Vaults, Drained Largest-First

The detail that makes this story worth following is how methodical the attacker has been. On-chain analysis from Galaxy Research shows the third-wave exploiter created 293 two-of-two multisignature vaults to warehouse victims’ coins. A multisig vault simply means the funds require two separate keys to move — an arrangement normally used for security, but repurposed here as a filing cabinet for stolen money.

The attacker isn’t draining everything at once. According to Galaxy, funds are being moved from the largest vaults first, in descending order of size, and the contents of the 11 largest vaults have already been moved. That largest-first pattern is classic cash-out behavior: take the biggest score while the trail is quiet, then work down the stack.

The trace work also paid off in an unexpected way. Galaxy says the transactions helped identify a previously unknown vault that likely held another Coldcard victim’s funds — though the firm noted the cause of that particular loss remains unconfirmed. In other words, following the money is still uncovering victims nobody had counted yet.

Zooming out across every wave of the Coldcard exploit, Galaxy estimates that roughly 82% of the stolen Bitcoin remains parked in the original attacker-controlled addresses, with about 18% already on the move for apparent laundering purposes. That means the majority of the haul is still sitting there — and still capable of pressuring the market when it moves.

The Core Conflict: Stolen Coins vs. Traceable Rails

There’s a tension at the heart of this story. Bitcoin’s public ledger means every movement of stolen funds is visible to anyone — including analytics firms like Galaxy, exchanges, and law enforcement. The attacker’s answer has been to hop across tools built for privacy: THORChain to swap into Ethereum, CoinJoin to obscure the trail, and presumably mixers or peer-to-peer cash-outs downstream.

It’s the same cat-and-mouse that has played out after nearly every major exploit this year. To put the Coldcard incident in scale: according to DefiLlama, it ranks as the third-largest exploit of 2026 so far, behind a 293 million USD Kelp DAO hack and a 280 million USD Drift protocol hack. Each time, the stolen funds sat quietly for weeks before the slow, careful laundering began — and each time, on-chain researchers watched it happen in near real-time.

The clock matters here. Historically, the window for freezing or intercepting stolen crypto is the narrow gap between the coins leaving the first wallet and reaching an exchange or mixer. With nearly a fifth of the Coldcard haul already in motion and 82% still waiting, investigators are racing a patient opponent.

Market Implications: Why a Hacker’s Bank Run Can Move Bitcoin’s Price

Here’s the part that touches your portfolio even if you’ve never touched a Coldcard. When large amounts of stolen crypto get laundered, it usually ends with selling. Coins swapped into Ethereum via THORChain may be sold there; coins that reach exchanges can hit the order books directly. A sustained dump of a large stolen stash adds sell pressure at exactly the wrong moments — and traders watch these flows the same way they watch ETF inflow data.

Bitcoin itself is trading around 79,400 USD as of the latest snapshot, holding near multi-month highs after a strong stretch for ETF inflows. Against that backdrop, the Coldcard cash-out is a modest but real supply overhang — not big enough to break the trend on its own, but worth watching on days when the market is thin.

The security takeaway matters more than the price one. This attack didn’t break Coldcard’s hardware or Bitcoin itself. Third-wave attacks like this typically target people — compromised supply chains, tampered devices, or tricked users — rather than the cryptography. If you hold self-custodied crypto, the practical checklist is short: buy hardware wallets only from the official manufacturer, verify the device’s authenticity on arrival, and treat any unexpected transaction prompt as hostile until proven otherwise.

There’s also a broader hygiene point. On the same news cycle, Trezor disclosed that a data breach affects tens of thousands of additional US customers — a reminder that even if your coins are safe, your personal data leaked from a wallet vendor can make you a target for phishing for years.

The Verdict: Watch the Vault, Not the Headline

The Coldcard saga is now in its most telling phase. The attacker spent a long time being patient; the move to THORChain and CoinJoin signals the cash-out is underway. Galaxy Research’s tracking will be the scoreboard to watch: if the remaining 82% starts moving faster, expect renewed chatter about market impact and law-enforcement action. If the trail goes cold in mixers, victims’ recovery odds fade.

For regular investors, the verdict is straightforward. None of this changes Bitcoin’s fundamentals, its ETF demand picture, or its long-term case. What it does change is the risk calculus for self-custody: the technology is sound, but the operational security around it is where fortunes are lost. Buy from official sources, verify your devices, keep large holdings in multisig with geographically separated keys, and remember that in crypto, the attackers are patient — your defense should be too.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.