**[Coldcard Attackers Continue Transferring Funds, Approximately 45% of Stolen Assets Enter Mixing or Cross-Chain Paths]** BlockBeats News, September 7: Galaxy Research published an article stating that attackers involved in the Coldcard "Wave 3" attack are still actively transferring stolen funds. During this phase, the attackers created 293 2-of-2 multisig vaults for each victim's assets. On September 2, the first batch of funds was transferred cross-chain to Ethereum via THORChain; the latest round of transfers has now entered the CoinJoin mixing process. Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of ranking by stolen value. They have sequentially transferred funds from vaults ranked 1 through 11. The next 10 vaults yet to be transferred collectively hold 30.81 BTC, while vaults ranked 61 through 293 collectively hold 33.77 BTC. As of now, the attackers have transferred approximately 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, the latest fund transfers revealed a previously unknown vault: 58 addresses jointly spent funds using the same 2-of-2 multisig format as Wave 3 and were further transferred by the Wave 3 attackers to a jump address funding CoinJoin. On-chain analysis teams have currently labeled this vault as "cause = open," but believe it likely also belongs to Coldcard victims. This suggests the number of vaults involved in Wave 3 may increase to 294, pushing the previously reported total stolen amount from the Coldcard vulnerability to approximately 1,806 BTC. At present, approximately 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred. The flow of funds indicates potential money laundering activities. [Original Link]