Coldcard Hacker Launders $7.8 Million in Bitcoin Through THORChain and CoinJoin

The hacker responsible for the recent Coldcard hardware wallet exploits has begun to launder a significant portion of the stolen funds. Approximately 97.09 BTC, valued at around $7.8 million, has been moved through cross-chain swaps and mixing services over a five-day period. This transaction represents about 45% of the total stolen Bitcoin from the third wave of attacks, as reported by Galaxy Research.

The laundering process commenced on September 2, when the funds were first routed through THORChain, where they were converted into Ether. Following this, additional transactions were executed through CoinJoin, a privacy technique that obscures transaction trails by bundling multiple users' transactions. The methodical approach taken by the attacker suggests a planned strategy rather than a hasty liquidation of assets.

The Coldcard exploits, which began on July 30, 2026, have resulted in confirmed losses of approximately 1,789 BTC, equating to around $114.7 million at the time of theft. Over 8,865 addresses have been affected, with the median victim losing more than 1 BTC. Despite the laundering efforts, 82% of the stolen Bitcoin remains in wallets controlled by the attacker, indicating that a significant portion of the funds has yet to be moved.

The choice of THORChain for laundering is significant due to its decentralized nature, allowing swaps without a centralized intermediary. This makes it difficult to reverse transactions, unlike centralized exchanges. The subsequent use of CoinJoin further complicates tracking efforts, although law enforcement agencies have had success in tracing funds laundered through similar methods in the past.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News