Coldcard Attacker Moves $7.7M in Bitcoin (BTC) From Wave 3 Vaults

An attacker who compromised Coldcard hardware wallets has begun moving stolen funds, transferring approximately 97 Bitcoin worth $7.7 million from Wave 3 vaults. The stolen bitcoin was routed through privacy-focused services including THORChain and CoinJoin, likely an attempt to obscure the trail. The breach appears to have involved the creation of multisignature vaults, suggesting a sophisticated exploitation of the wallet's architecture. The majority of the stolen bitcoin - roughly 82% - remains stationary on the blockchain, indicating the attacker is moving funds in stages rather than attempting a single large conversion.

• Attacker has moved ~97 BTC ($7.7M) from compromised Wave 3 Coldcard vaults using privacy mixers, with the rest of the haul still idle on-chain.
• The exploit involved creating multisignature vaults, pointing to manipulation of Coldcard's vault structure as part of the attack vector.
• Staged fund movement through THORChain and CoinJoin suggests deliberate attempts to obscure transaction origins and complicate fund tracking.