Coldcard exploiter moves funds through THORChain and CoinJoin
September monitoring reported movements of proceeds from the third Coldcard exploitation wave through THORChain and CoinJoin. The transfers were a later handling of previously stolen bitcoin, rather than a new September wallet exploit.
Funds associated with the third wave of Coldcard exploitation moved during September 2–6, 2026, according to Galaxy monitoring reported by The Block on September 7. The account described a September 2 conversion from Bitcoin to ether through THORChain and subsequent CoinJoin activity on September 6.
THORChain provides a route between assets on different blockchains, while CoinJoin combines transaction inputs and outputs in ways that complicate tracing. The reported activity therefore concerned how an exploiter handled proceeds after the theft, not another failure of Bitcoin’s consensus system.
The wave-specific figures in the monitoring should not be confused with the entire incident’s losses or recoveries. Movement also did not establish that the victim funds had been returned. September’s development added a tracing and asset-conversion stage to the Coldcard episode, with the underlying wallet compromise remaining an earlier event.