The attacker behind the third wave of Coldcard thefts has moved roughly 97.09 BTC, valued at about $7.7 million, representing around 45% of the bitcoin taken in that wave, according to Galaxy Research.

The funds were shifted in three stages, employing THORChain and CoinJoin techniques to hide the trail.

On September 2, about 20.5 BTC from the largest vault was sent via THORChain to an Ethereum address.

On September 5, 15.48 BTC from the second‑largest vault entered a CoinJoin transaction, followed the next day by 61.12 BTC from ten additional vaults.

Galaxy Research noted that the attacker has now emptied the 11 largest vaults linked to the third wave; the next ten vaults hold 30.81 BTC, while vaults 61 through 293 contain a combined 33.77 BTC.

These vaults are not the users’ own wallets; they were created by the exploiter, each holding a victim’s coins in a two‑of‑two multisig arrangement requiring two keys to move funds.

Including an additional vault tied to 58 addresses would raise the total to 294 vaults and the overall exploit to roughly 1,806 BTC, worth about $143.9 million.

Approximately 82% of the stolen bitcoin remains at attacker‑controlled addresses, with 18% moved through transactions designed to obscure the flow.

The thefts started on July 30 after a flaw in Coldcard firmware weakened the randomness used to generate wallet seeds.

Coinkite has issued patched firmware, but stressed that affected users must generate new seeds and transfer their holdings, as the update cannot fix already compromised wallets.

Anvil is a shared on‑chain collateral layer built on a programmable letter of credit: reserve assets serve as a guarantee, with no loan, no interest, and users retain custody and yield.