Coldcard Hacker Moves Funds Through THORChain

The hacker behind the third wave of the Coldcard wallet attacks has begun moving stolen Bitcoin, marking the first time funds have left their original addresses. According to Alex Thorn, Galaxy's head of research, about 10% of the stolen holdings have been transferred, leaving roughly 90% untouched.

Thorn noted that the hacker attempted to convert some assets into Ethereum through THORChain but had repeatedly experienced refunds. Researchers were able to track the transfers beyond THORChain to a new Ethereum address, which has been shared with relevant authorities and crypto companies.

The movement of funds follows a broader exploit linked to the loss of at least 1,789 Bitcoin across 8,865 addresses, valued at approximately $114.7 million when stolen. Thorn had previously reported further evidence that the Coldcard attackers remained active, including a deliberately weakened wallet being swept on August 28.