Coldcard hacker swaps stolen Bitcoin for ETH via THORChain

The THORChain Swap

A hacker linked to the third wave of Coldcard wallet thefts has started swapping stolen Bitcoin for Ether through THORChain.

Galaxy head of research Alex Thorn took to X on Wednesday to report that the third-wave exploiter moved about 10% of the stolen funds, with 90% remaining untouched. Thorn said it marked the first time funds from any of the three waves had moved onchain from the original hacker addresses.

"The hacker appears to be having some issues swapping all the funds through THORChain - they keep getting refunded and he keeps retrying," he said.

Onchain Tracing

Onchain analysts traced the funds through THORChain to a new Ethereum address. Thorn said he shared it with relevant authorities and crypto companies. It remains unclear whether the attacker will attempt to further obscure or move the assets through an exchange, he added.

Background: The Coldcard Exploit

The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time they were stolen.

Previous Mixer Activity

Blockchain security company CertiK reported in August that hackers linked to the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.

Ongoing Threat

The latest movement comes days after Thorn said the Coldcard attackers remained active, citing the Aug. 28 sweep of a deliberately weakened researcher wallet designed to test the attackers' ability to find vulnerable keys.

Related: Lazarus Group-linked addresses move $30M through Hyperliquid