Coldcard Hacker is Moving The Stolen Bitcoin Galaxy Research says the Wave 3 Coldcard attacker has moved 45% of that cluster. The operator first swapped stolen bitcoin for ether through THORChain on Sept. 2. On Sunday, the same operator ran stolen bitcoin through CoinJoin

What happened

Galaxy Research reports that the Wave 3 Coldcard attacker has moved 45% of the stolen bitcoin cluster. The operator first swapped stolen bitcoin for ether through THORChain on September 2, and on Sunday ran more stolen bitcoin through CoinJoin.

Confirmed

Global impact / market context

Moving stolen bitcoin through CoinJoin, which mixes coins to hide their origin, makes it harder for authorities to track and recover funds. This could increase regulatory scrutiny on privacy tools and affect investor confidence in bitcoin's security.

Analyst inference

Bitcoin's reputation depends on secure storage and traceable transactions. If stolen funds are successfully laundered, concerns may arise about self-custody solutions like Coldcard wallets, potentially influencing investor trust and demand for bitcoin.

Analyst inference

What to watch

1. Monitor whether the Coldcard attacker moves the remaining portion of the stolen bitcoin cluster, as reported by Galaxy Research. Confirmed
2. Watch for any statements from THORChain or CoinJoin providers about their cooperation with law enforcement or changes to their protocols. Proposed
3. Observe if bitcoin's price or trading volumes react to news of the theft and laundering, which might reflect investor sentiment about security. Analyst inference

Affected assets

• BTC — Bitcoin

Evidence

• x.com