My colleagues from the analytical division Galaxy Research have recorded a new phase in the movement of funds stolen during the third wave of targeted attacks on users of Coldcard hardware wallets. This refers to the transfer of stolen bitcoins into the CoinJoin protocol — a mechanism that radically complicates transaction traceability by mixing payments from many independent participants into a single pool operation.
This is not the first step by the attacker to launder illegally obtained assets. Earlier, the hacker converted part of the coins into Ethereum through the decentralized cross-chain protocol THORChain, which made it possible to break the direct link between the original BTC and their subsequent movements. Now, the use of CoinJoin points to a well-thought-out, multi-stage money laundering strategy aimed at completely erasing digital traces.
Why CoinJoin is a challenge for investigations
The CoinJoin technology, underlying tools such as Wasabi Wallet or Samourai Whirlpool, combines transactions from different users into one. For an external observer, it is extremely difficult to determine which output belongs to a specific address. For blockchain analysts, this creates serious obstacles: standard clustering methods and heuristics lose effectiveness, and the likelihood of erroneous attribution of funds increases manyfold.
This incident is a vivid reminder that even hardware wallets, considered the gold standard of security, are not a panacea. The attacks on Coldcard, apparently, were aimed at vulnerabilities in initialization processes or phishing schemes, rather than at breaking the cryptography of the device itself. The hacker is acting methodically, using all available tools to conceal their identity and the final destination of the funds.
My expert assessment: Under current conditions, law enforcement agencies and blockchain detectives will have to rely not only on on-chain data analysis, but also on monitoring exchange platforms and over-the-counter (OTC) services, where fiat withdrawal will eventually occur sooner or later. CoinJoin delays identification, but does not make it impossible — especially if the attacker makes a mistake when converting to fiat currencies or using KYC platforms.