Coldcard hacker launders more stolen BTC, with 18% of total moved

About 18% of the total Bitcoin stolen in the Coldcard exploit is estimated to have been moved for laundering, while the remaining 82% is still held in the original addresses controlled by the attacker, according to Galaxy Research on X. Galaxy Research said the attacker created 293 2-of-2 multisig vaults during the third attack to hold BTC stolen from individual victims. Of that amount, 45% has so far been moved to the Ethereum network through THORChain (RUNE) or deposited into CoinJoin. Galaxy Research also estimated a newly identified vault is likely tied to victim funds. Including that wallet, the number of vaults linked to the third attack rises to 294, bringing the total amount stolen across the Coldcard exploit to about 1,806 BTC.