Galaxy Research: Coldcard Attackers Continue Moving Stolen Funds

Galaxy Research reported that attackers behind the Coldcard 'Wave 3' exploit are actively moving stolen assets. Approximately 45% of the stolen funds have been transferred via THORChain to Ethereum or processed through CoinJoin mixers. The attackers are systematically draining the largest vaults first, having already processed the top 11. On-chain analysis identified an additional vault, potentially increasing the total number of affected vaults to 294 and the estimated total loss to approximately 1,806 BTC. Currently, about 18% of the stolen BTC has been m