The laundering route
THORChain is a cross-chain protocol that lets users swap assets between different blockchains without a centralized exchange. CoinJoin is a privacy technique that mixes multiple transactions together, breaking the link between sender and receiver. By running the stolen Bitcoin through both, the attacker can effectively wash the trail. The 45% figure means nearly half of the haul has been pushed through these tools, according to Galaxy. That's a lot of value to move through a single route, and it suggests the attacker has a clear plan.
Galaxy's tracking
Galaxy's research team flagged the movement, though the report doesn't specify exactly when the transfers happened or how long they took. What's clear is that the attacker is methodical. Moving that much value through THORChain and CoinJoin isn't a one-off mistake; it's a deliberate effort to obscure the funds' origin. The report also doesn't say where the remaining 55% sits, but the fact that nearly half is already in the privacy blender is a red flag for anyone hoping to recover the money.
A harder trail for investigators
The Coldcard attack itself was a security failure, but the laundering is a second problem. Once Bitcoin goes through a mixer and a cross-chain swap, it becomes nearly impossible to follow with standard blockchain analytics. That's a problem for exchanges, which often freeze funds once they're flagged, and for law enforcement, which needs a clear paper trail to make arrests. The use of THORChain adds another layer: it moves the Bitcoin off the original chain, so even
