The attacker tied to the Coldcard "Wave 3" incident is still moving stolen funds, according to Odaily. In this phase, the attacker created 293 separate 2-of-2 multisig vaults, one for each victim’s assets. The first batch of funds was bridged to Ethereum through THORChain on Sept. 2, while the latest round of transfers has started entering the CoinJoin mixing process.
Tracking shows the attacker is processing the largest balances first, based on the ranking of stolen amounts, and has already moved vaults ranked No. 1 through No. 11. The next 10 unmoved vaults hold a combined 30.81 BTC, while vaults ranked No. 61 through No. 293 hold a combined 33.77 BTC. So far, around 45% of the assets stolen in the exploit have been moved either to Ethereum or into CoinJoin transactions.
Investigators also identified a previously unknown vault. In that case, 58 addresses spent funds together using the same 2-of-2 multisig structure seen in Wave 3, and the funds were then sent by the attacker to a hop address used to finance CoinJoin. The vault is currently labeled "cause = open," but it may also belong to Coldcard victims. If confirmed, the total number of Wave 3 vaults could rise to 294, and the previously reported stolen total for the Coldcard exploit could increase to about 1,806 BTC.
The attacker behind the Coldcard "Wave 3" incident is still moving stolen funds, according to Odaily.
During this phase, the attacker created 293 separate 2-of-2 multisig vaults for victims' assets. On Sept. 2, the first batch of funds was bridged to Ethereum through THORChain. The latest round of transfers has now started entering the CoinJoin mixing process.
Largest vaults are being processed first
Tracking indicates the Wave 3 attacker is handling the biggest balances first, ranked by the amount stolen, and has already moved vaults ranked No. 1 through No. 11.
The next 10 vaults that have not yet been moved hold a combined 30.81 BTC. Vaults ranked No. 61 through No. 293 hold a combined 33.77 BTC.
About 45% of stolen assets have already been moved
So far, about 45% of the assets stolen in the exploit have been transferred, with funds either moving to Ethereum or entering CoinJoin transactions.
A previously unknown vault was also identified
The latest fund movements also revealed a previously unknown vault. In that case, 58 addresses spent funds together using the same 2-of-2 multisig format seen in Wave 3, and the attacker then routed the funds to a hop address used to fund CoinJoin.
The vault is currently tagged as "cause = open," but it may also belong to Coldcard victims. If that is confirmed, the number of vaults involved in Wave 3 could rise to 294, and the previously reported amount stolen in the Coldcard exploit could increase to about 1,806 BTC.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
