Coldcard Hacker Begins Moving Stolen Bitcoin Through THORChain

A hacker connected to the third wave of Coldcard hardware wallet thefts has started converting a portion of the stolen Bitcoin into Ether using the cross chain platform THORChain. According to blockchain researcher Alex Thorn from Galaxy, the attacker has moved roughly 10% of the stolen funds so far, with the remaining 90% still untouched. This marks the first time funds from any of the three known Coldcard theft waves have moved from the original hacker-controlled addresses.

Thorn noted that the attacker appears to be facing technical difficulties completing the swaps, with several transactions being refunded and repeatedly retried through the platform.

Funds Traced to New Ethereum Address

Onchain analysts were able to trace the swapped funds to a newly created Ethereum address, which has reportedly been shared with relevant authorities and cryptocurrency companies for further monitoring. It remains unclear whether the attacker plans to move the assets through an exchange or attempt further obfuscation.

Background on the Coldcard Exploit

The transfers follow a broader Coldcard wallet exploit that resulted in the theft of over 1,700 Bitcoin from thousands of addresses, valued at more than $100 million at the time of the theft. Security researchers previously reported that hackers linked to the incident had already funneled a portion of the stolen Bitcoin and Ether through cryptocurrency mixing services in an earlier attempt to obscure the funds’ origin.