Coldcard Hacker Moves 97 BTC via THORChain and CoinJoin

| cryptodaily.co.uk
The Coldcard hacker moved 97.09 BTC between September 2 and September 6, equal to about 45% of Bitcoin stolen in the third attack wave. Around 20.5 BTC went through THORChain into Ethereum, while 15.48 BTC and 61.12 BTC entered CoinJoin transactions. The funds came from 11 of 293 Wave 3 multisignature vaults, reportedly the largest wallets in the group. Galaxy Research estimates that the wider Coldcard theft involved about 1,806 BTC, worth roughly $143.9 million. About 82% of the stolen Bitcoin remains in attacker-controlled addresses, so the latest Coldcard hacker transfers do not yet indicate a full liquidation. CoinJoin remains the main route for moved BTC, while THORChain supports cross-chain transfers into Ethereum. The Coldcard exploit resulted from a seed-generation flaw introduced in a March 2021 firmware update. The error caused some wallets to rely on a weak software random-number generator, reducing seed security and allowing private keys to be regenerated offline. Later firmware updates cannot repair vulnerable seeds. Traders should monitor further Bitcoin wallet movements, exchange deposits and privacy-routing activity for potential selling pressure. BTC showed limited price reaction, trading near $79,500 after recently approaching $82,000.
Neutral
The immediate price impact on BTC is likely neutral. The hacker moved 97.09 BTC, but this represents only about 18% of the estimated 1,806 BTC stolen across all attack waves, leaving roughly 82% in the original attacker-controlled addresses. Although CoinJoin and THORChain activity may signal efforts to obscure the funds and could create short-term selling pressure if coins reach exchanges, no broad exchange liquidation has been reported. BTC also showed limited reaction to the transfers, trading near $79,500 after recently approaching $82,000. In the short term, traders may watch blockchain flows, exchange deposits and additional vault spending for signs of distribution. Over the longer term, the exploit could weaken confidence in affected Coldcard devices and increase scrutiny of hardware-wallet security, but it is unlikely by itself to materially change Bitcoin’s wider market trend.