The attacker associated with the third wave of Coldcard wallet thefts is prioritizing the largest portion of a vault batch, moving 97.09 BTC worth about $7.7 million, or roughly 45% of that batch. The attacker created 293 two-of-two multisignature vaults and began moving some tokens through THORChain on Sept. 2 before routing multiple transfers through CoinJoin over the weekend. The exploit stemmed from a 2021 firmware flaw that reduced seed entropy to a minimum of 40 bits. About 82% of the tokens stolen in the exploit remain unmoved. Earlier transfers reached Ethereum through THORChain, while CoinJoin activity can complicate transaction tracing without proving that funds were successfully laundered. A compromised recovery seed cannot be repaired by firmware updates; affected users need a fresh seed and must transfer remaining assets.