Coldcard attackers continue transferring funds, with approximately 45% of the stolen assets having entered mixing or cross-chain paths.

Galaxy Research has released a report noting that attackers behind the Coldcard "Wave 3" breach are still actively transferring stolen funds. During this phase, the attackers created 293 2-of-2 multisig vaults for each victim’s individual assets. On September 2, the first batch of funds was cross-bridged to Ethereum via THORChain, while the latest round of transfers has entered the CoinJoin mixing process. Currently, the Wave 3 attackers are processing the largest stolen funds in descending order of amount, having sequentially transferred vaults ranked 1 through 11 so far. The next 10 untransferred vaults hold a combined 30.81 BTC, while vaults ranked 61 to 293 hold a total of 33.77 BTC. To date, the attackers have moved approximately 45% of the total stolen funds from the exploit, with funds flowing either to Ethereum (via THORChain) or into CoinJoin mixing transactions. Additionally, a previously unknown vault was uncovered in the fund transfers: 58 addresses co-spent via 2-of-2 multisig matching the Wave 3 format, and were further transferred by the attackers to a jump address that supplies CoinJoin. On-chain analytics teams have labeled this vault as "cause = open" but believe it is very likely also a Coldcard victim, meaning the total number of vaults involved in Wave 3 could rise to 294, pushing the previously disclosed total stolen BTC from the Coldcard exploit to roughly 1,806 BTC. As of now, around 82% of the stolen BTC remains in the attackers’ initially controlled addresses, while approximately 18% has been transferred, with fund flows indicating potential money laundering activity.