Coldcard Hacker Swaps Stolen Bitcoin for ETH via THORChain
A hacker linked to the third wave of Coldcard wallet thefts has started swapping stolen Bitcoin for Ether through THORChain. According to Galaxy head of research Alex Thorn, about 10% of the stolen funds have been moved, with 90% remaining untouched. This marks the first time funds from any of the three waves have moved onchain from the original hacker addresses.
Thorn reported that the hacker is experiencing issues swapping all the funds through THORChain, as they keep getting refunded and retrying. Onchain analysts traced the funds to a new Ethereum address, which Thorn shared with relevant authorities and crypto companies.
The transfers follow a Coldcard exploit that linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time they were stolen. The hacker also sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash in August.
Thorn noted that the Coldcard attackers remain active, citing the Aug. 28 sweep of a deliberately weakened researcher wallet designed to test their ability to find vulnerable keys.