The exploiter behind the third wave of the Coldcard hack has transferred approximately 45% of their Bitcoin haul. The transactions were routed through THORChain and CoinJoin mixers, according to a report from Galaxy Research published on September 7, 2026.
Author: Liam Hunter
Liam Hunter
Liam Hunter focuses on the on-chain systems where liquidity, risk and protocol mechanics become visible. He writes about DeFi, DEXes, perpetuals, Smart Money flows, hacks and Ethereum-linked infrastructure, with an emphasis on what the data shows, what remains uncertain and where market interpretation can go too far.Market developments and regulatory context are part of his reporting when they intersect with Web3 or DeFi activity.
Read More
A new Trezor data breach exposed personal records of 67,000 additional customers across the United States, as confirmed by the manufacturer in an official statement released on September 4, 2026. The incident originated at its logistics provider ShipMonk due to contractual noncompliance in purging order records fulfilled between November 2019 and August 2021.
The Office of the Comptroller of the Currency marked a regulatory milestone by granting approval for crypto firms to organize national banks. This federal determination integrates digital asset enterprises directly into the United States banking framework without relying on traditional sponsor lenders.
A hacker linked to the third wave of the Coldcard wallet compromise began converting stolen Bitcoin into Ether through THORChain. Onchain monitoring indicates that the attacker moved roughly 10% of the stolen funds, leaving the remaining 90% untouched across the original addresses.
Full Sail announced its protocol shutdown on Tuesday, September 1, 2026. The project decided to permanently dissolve operations after an attacker extracted approximately $91,000 across three automated vaults during a major security incident involving oracle infrastructure provider Switchboard.
The Hyperliquid Strategies treasury entity formally executed the contractual amendment on September 1, 2026, expanding its financing line with Chardan Capital Markets from $1.0 billion to $2.5 billion. The transaction appears in an SEC regulatory filing that authorizes the Nasdaq-listed firm to issue new common shares periodically across public markets to support capital deployment.
Crypto wallet addresses linked to the North Korean cyber syndicate Lazarus Group moved $30 million in assets through the decentralized exchange Hyperliquid on September 1, 2026. The organization remains under sanctions by the US Office of Foreign Assets Control. On-chain transaction data showed that the identified wallets routed initial deposits in Bitcoin to Hyperliquid and the bridging platform HyperUnit. The operators subsequently traded the assets into Ether and Solana within the protocol ecosystem. Following the conversion, the funds were bridged across the Tron, Solana, and Ethereum blockchains. This multi-chain routing was designed to split the transaction volume and obscure transaction…
United States spot Bitcoin exchange-traded funds recorded $216.7 million in net inflows on Monday, August 31, 2026. According to market data published by SoSoValue tracking ETF assets, this positive movement reversed the $201.8 million in net capital withdrawals observed on the preceding Friday.
Cronos validators halted block production on August 30, 2026, after detecting a security incident on lending platform Tectonic. Officials representing the Cronos blockchain network confirmed a preventive system halt while technical teams investigate the underlying exploit.
Decentralized credit platform SOIL has launched a new XRP yield generation vault offering 5% annual percentage rate. The deployment aims to structure institutional-grade return mechanisms directly within the XRPL financial ecosystem.
