Nearly half of the bitcoin stolen in the third wave of the Coldcard exploit, 97.09 Bitcoin, worth about $7.7 million, has now been laundered across two key rails. The first major movement began on September 2, when about 20.5 bitcoin left the largest attacker-controlled vault. The coins moved through THORChain, which allows value to shift between blockchains without a central intermediary, and then appeared on Ethereum. More recently, the funds took a second step by entering CoinJoin rounds, mixing them with other Bitcoin transactions to obscure which output is which.
This laundering sequence matters because each step makes tracing harder. THORChain breaks connections as money jumps chains, while CoinJoin muddies the trail inside Bitcoin itself. Public blockchains still show that the coins moved, and investigators can often follow broad patterns. But after CoinJoin, it becomes much harder to link a specific input to a specific output, making recovery more difficult and more time-sensitive.