Galaxy

Read

Cryptocurrency

THORChain

Bitcoin

<p><strong>Galaxy reports that the attacker behind the Coldcard-linked Bitcoin theft has moved 45% of the stolen BTC, routing the funds through the cross-chain swap protocol THORChain and the privacy technique CoinJoin.</strong></p><div style="background:#0d0f17;border-left:3px solid #ffd740;padding:16px 20px;margin:20px 0;border-radius:4px;"><p style="margin:0 0 8px;color:#ffd740;font-weight:600;font-size:14px;">TLDR KEYPOINTS</p><ul style="margin:0;color:#e6edf3;"><li>Galaxy reports the attacker has moved 45% of the stolen Bitcoin.</li><li>THORChain and CoinJoin are named as the fund-movement routes.</li><li>The available context does not establish the theft mechanism or the total amount stolen.</li></ul></div><h2 id="galaxy-reports-movement-of-45-of-stolen-bitcoin">Galaxy reports movement of 45% of stolen Bitcoin</h2><p>The finding is attributed to Galaxy, which reports that roughly <a href="https://cryptobriefing.com/coldcard-attacker-moves-stolen-bitcoin-galaxy/" rel="noopener noreferrer nofollow">45% of the stolen Bitcoin</a> has been moved by the attacker. The share describes funds in motion, not a recovery or a seizure. For related coverage, see <a href="https://www.coinlive.me/coldcard-firmware-5-6-1-user-entropy-new-seeds-100-million-exploit/" rel="noopener noreferrer nofollow">Coldcard Releases Firmware 5.6.1 After $100M Exploit Claim, Adds User Entropy for New Seeds</a>.</p><h3 id="what-the-reported-45-represents">What the reported 45% represents</h3><p>The 45% is a reported share of the stolen Bitcoin that has been moved. The available context does not convert that share into a BTC quantity or a dollar figure, and no total stolen amount is established here. For related coverage, see <a href="https://www.coinlive.me/liquid-network-hack-watcherguru-4000-bitcoin-withdrawal/" rel="noopener noreferrer nofollow">Liquid Network Hack: WatcherGuru Reports 4,000 BTC Withdrawal</a>.</p><p>The label "Coldcard attacker" reflects how the incident has been described in the reporting. It does not, on this evidence, indicate a device compromise, a hardware vulnerability, or manufacturer responsibility. Coinlive has separately tracked claims that the wider <a href="https://www.coinlive.me/coldcard-exploit-tops-100-million-stolen-btc/" rel="noopener noreferrer nofollow">Coldcard exploit tops $100 million in stolen BTC</a> and that a <a href="https://www.coinlive.me/suspected-fourth-wave-coldcard-wallet-attacks-449-btc-risk/" rel="noopener noreferrer nofollow">suspected fourth wave of attacks put 449 BTC at risk</a>.</p><h2 id="thorchain-and-coinjoin-are-named-as-fund-movement-routes">THORChain and CoinJoin are named as fund-movement routes</h2><p>Galaxy names two routes for the reported movement: THORChain and CoinJoin. The 45% figure applies to the reported movement involving those routes together; it is not a split assigned to each route individually.</p><h3 id="thorchain-s-mention-in-the-reported-movement">THORChain's mention in the reported movement</h3><p>THORChain, a cross-chain swap protocol, is cited as one route used in the reported transfers. The context provides no transaction records, no destination assets, and no wallet identifiers tied to that route.</p><h3 id="coinjoin-s-mention-in-the-reported-movement">CoinJoin's mention in the reported movement</h3><p>CoinJoin, a coin-mixing technique, is the second named route. Its mention describes how funds were reportedly moved and does not indicate that THORChain or CoinJoin operators participated in or endorsed the theft.</p><h2 id="what-the-supplied-information-leaves-unresolved">What the supplied information leaves unresolved</h2><p>Moving funds does not, on this evidence alone, establish a sale, a cash-out, or a permanent loss of traceability. On-chain movement and successful laundering are not the same claim, and none of the underlying transactions are shown here. Readers can independently monitor Bitcoin network activity via <a href="https://mempool.space/" rel="noopener noreferrer nofollow">Mempool.space</a>.</p><p>The remaining 55% is not described here as stationary, recovered, frozen, or still under the attacker's control; the available context simply does not say. Prior coverage of the incident set out <a href="https://www.coinlive.me/coldcard-exploit-what-happened-why-bitcoin-is-stronger-than-ever/" rel="noopener noreferrer nofollow">what happened in the Coldcard exploit</a> for additional background.</p><p>The total stolen amount, the timing of the theft and transfers, the theft mechanism, and transaction-level evidence are absent from the supplied context. Those are limits of the information at hand, not necessarily gaps in Galaxy's underlying report.</p><p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.coinlive.me/?p=95310" rel="noopener noreferrer nofollow">Read original article on coinlive.me</a>

Coldcard Attacker Moves 45% of Stolen BTC, Galaxy Reports

Table of Contents

Coinlive.me

Other articles published on Sep 7, 2026

Liquid Network Halts Operations Following $320M Bitcoin Vulnerability Exploit

Chainlink (LINK) Price: Analyst Eyes $20 Target After Breakout Above $12

UBS Reverses Course: Predicts Fed Will Hike Rates Twice in 2026

Zcash climbs past $1,200, whale short on Hyperliquid shows $25.7 million loss

$BTOWN Goes Live Sept. 15: A Straight Look at Battle Town's $13.5M Public Sale

US CEO Reveals Bitcoin (BTC) Bottom and Price Prediction! Shares Altcoin He Made 1000x Profit Fro...

Join our free newsletter for daily crypto updates!