Coldcard Hacker Swaps Stolen BTC to ETH via THORChain

The Coldcard hacker has moved stolen Bitcoin for the first time since the Wave 3 attack. The attacker transferred part of the funds and swapped it into Ethereum through THORChain, marking the first direct movement from addresses linked to Waves 1-3.

This cross-chain movement complicates investigator tracking and highlights ongoing crypto security and forensic risks as funds move beyond Bitcoin.

The hacker's actions have shifted from earlier behavior where stolen Bitcoin remained untouched. According to Galaxy Digital research head Alex Thorn, the exploiter transferred part of the stolen BTC and swapped it into Ethereum through THORChain.