Coldcard Movements: Attacker shifted 97.09 BTC ($7.7 million), routing funds through THORChain and CoinJoin while working through the largest vaults. Coldcard Vault Structure: Galaxy said the exploiter created 293 multisignature vaults and likely added a previously unknown one, raising Wave 3 to 294 vaults and expanding the Coldcard theft's scale.