Coldcard Wave 3 Attacker Moves $1.6M in BTC via THORChain — What 90% Still Parked Means for Leveraged Traders

Event Summary

As reported by Cointelegraph, ForkLog, and on-chain analytics firms Galaxy Research and Bitquery, the attacker behind the third wave of the 2026 Coldcard firmware exploit has begun laundering stolen funds. According to Bitquery, approximately 20.45 BTC was moved across 34 on-chain swaps on September 2–3, 2026, routed from attacker-controlled Bitcoin addresses through THORChain into a newly identified Ethereum address — representing roughly $1.6M at current prices.

Galaxy Research's Alex Thorn confirmed this marks the first significant on-chain movement from Wave 3 addresses. Critically, this $1.6M represents only ~10% of the Wave 3 stash; the remaining ~90% has not moved. The broader Coldcard exploit, which targeted a firmware bug in Mk2/Mk3 devices allowing private key reconstruction, has drained an estimated $100M–$130M in BTC across multiple waves since late July 2026. Prior laundering behavior included 64 BTC into Wasabi and 200 ETH into Tornado Cash.

Leverage Impact Analysis

BTC is trading at $80,926 (24h range: $80,862–$81,458, up 4.70% on the day per live data), meaning the $1.6M movement is negligible mechanical sell pressure relative to daily BTC volume. The leverage risk is not from this transaction alone — it's from the forward signal: 90% of Wave 3 funds remain unlaundered, and prior waves show a pattern of escalating activity.

Consider a trader holding a 50x long BTC perpetual opened at $80,926 on CoinUnited.io. A 2% adverse move to ~$79,308 triggers liquidation — well within reach if a larger laundering wave (say, 150–200 BTC) hits THORChain pools in a single session and media amplifies the narrative. Conversely, current price momentum (+4.70%) suggests bulls hold the near-term edge, meaning overleveraged shorts face squeeze risk if this event fails to dent sentiment.

Funding rates on BTC perpetuals should be monitored closely — elevated positive funding in a hack-headline environment signals crowded longs that could flush violently if a second wave of movement is confirmed. Check crypto funding rates on CoinUnited.io for live positioning signals before sizing high-leverage entries.

Cross-Market Impact

THORChain (RUNE) carries the highest direct risk: being explicitly named as the laundering infrastructure invites regulatory scrutiny and potential exchange de-listing pressure, creating a negative sentiment overhang distinct from BTC/ETH price action.

For crypto-proxy equities, the self-custody failure narrative may incrementally benefit custodial platforms. Coinbase Global, Inc. could see narrative tailwinds as users potentially shift from hardware wallets to regulated custody — a flow that supports AUC and fee revenue. MicroStrategy Inc and Marathon Digital Holdings, Inc. carry BTC price sensitivity but are not directly exposed to the self-custody risk story. The broader narrative reinforces the self-custody and cross-chain infrastructure risk theme already pricing into DeFi bridge and mixer protocols.

Regulatory risk is the longer-duration cross-market channel: repeated visible laundering via cross-chain infrastructure strengthens the case for KYC/AML rules on bridges and DEXs, which could reprice the entire DeFi sector and accelerate crypto regulatory enforcement actions.

Trading Considerations

BTC's 24h low of $80,862 is the immediate support to watch — a confirmed break below with volume would open a test of the $79,000–$79,500 zone. The key risk event is not this $1.6M tranche but whether the remaining ~90% of Wave 3 funds (estimated 180+ BTC equivalent) begins moving in subsequent sessions; that volume would be large enough to create genuine order-book impact on lower-liquidity venues.

Monitor THORChain pool depth and open interest on BTC perpetuals for confirmation signals. Traders running positions above 20x leverage should set wider stops than typical given the binary nature of the remaining unlaundered supply overhang — a sudden large on-chain movement could trigger a sharp sentiment-driven spike in volatility before price mean-reverts.

Trade Bitcoin on CoinUnited.io

Trade BTC with up to 2000x leverage → | Create Free Account

_Availability and maximum leverage depend on product, jurisdiction and account eligibility. Leverage amplifies losses and positions can be liquidated._