Coldcard Hacker Uses THORChain to Swap Stolen BTC for ETH

A hacker associated with the third wave of Coldcard wallet thefts has started converting stolen Bitcoin into Ether through THORChain, according to Alex Thorn from Galaxy Research. The conversions began on September 3.

The hacker moved approximately 10% of the stolen Bitcoin through THORChain, which is a cross-chain decentralized exchange that allows users to exchange native assets across blockchains without depositing funds into a centralized exchange.

However, not all transactions were successful. Thorn reported that the hacker experienced technical problems while attempting to process the swaps, and some swap attempts were refunded by THORChain. The cause of the refunds is unclear, but possible explanations include liquidity limitations or protocol safeguards.

The movement represented the first detected on-chain transfer from the original addresses associated with the first three attack waves. Galaxy Research previously attributed 1,789 Bitcoin to the thefts, which is worth approximately $114.7 million. Around 90% of the stolen funds remain unmoved.