Coldcard Attacker Launder 45% of Third-Wave Bitcoin Haul via THORChain

The third-wave exploiter of the Coldcard wallet breach moved approximately 45% of their stolen Bitcoin by routing funds through THORChain and CoinJoin transactions. Galaxy Research identified that the attacker created 293 two-of-two multisignature vaults to hold victims' coins, and recently drained the 11 largest ones. Despite this recent laundering activity, roughly 82% of the Bitcoin stolen across all waves of the Coldcard attack remains parked in the original attacker-controlled addresses. DefiLlama data indicates the Coldcard exploit ranks as the third-largest exploit so far in 2026, sitting right behind the $293 million Kelp DAO hack and the $280 million Drift protocol incident.