Coldcard Hackers Launder Stolen Bitcoin Through THORChain and Tornado Cash

The recent Coldcard exploit has resulted in an estimated loss of $100 million for thousands of users, highlighting the vulnerability of crypto wallets.

Suspicious movements of funds linked to the incident have been detected on THORChain and Tornado Cash. Two separate 200 ETH deposits into Tornado Cash were made on August 5, 2026, from an Ethereum address that received Bitcoin converted through THORChain before the proceeds were mixed.

The pattern of activity matches classic post-theft laundering steps: BTC drained from Coldcard-linked addresses, swapped via THORChain's decentralized liquidity network into ETH, briefly held at a single intermediary, then deposited into Tornado Cash. The address itself showed limited prior activity outside these inflows, reinforcing its role as a temporary collection point.