Galaxy Research: Coldcard attacker moved ~45% of stolen assets

The attacker's methodical, automated drain—processing vaults in descending order of value—suggests a deliberate strategy to maximize extraction before detection or intervention. The use of THORChain and CoinJoin mixers indicates a sophisticated laundering pipeline, which could complicate recovery efforts and set a precedent for how cross-chain theft is traced. With roughly 55% of assets still in untouched vaults, the pace and pattern of future transfers will be the key signal for whether the attacker accelerates or encounters friction. For the broader market, this highlights the persistent risk in hardware wallet custody, even when multisig setups are used, and raises questions about the effectiveness of current tracing and freezing mechanisms.