Galaxy Research: Coldcard Attacker Moves 45% of Stolen Assets, Total Theft Estimated at 1,806 BTC

Galaxy Research reports that the Coldcard 'Wave 3' attacker continues to move stolen funds. The attacker, who created 293 2-of-2 multi-signature vaults, began bridging funds to Ethereum via THORChain on September 2 and has recently utilized CoinJoin. Approximately 45% of the stolen assets have been moved, with significant holdings remaining in various vaults.