Coldcard Hacker is Moving The Stolen Bitcoin Galaxy Research says the Wave 3 Coldcard attacker has moved 45% of that cluster. The operator first swapped stolen bitcoin for ether through THORChain on Sept. 2. On Sunday, the same operator ran stolen bitcoin through CoinJoin