Coldcard Stolen Bitcoin Routed Through THORChain in First Recorded Departure

The third wave of Coldcard hardware wallet attacks has seen stolen Bitcoin leave the attacker's original addresses, with some funds being routed through the decentralized exchange THORChain. This marks the first recorded departure from the original attacker addresses across all three waves.

Alex Thorn, head of research at Galaxy, highlighted this movement as active laundering through DeFi/DEX infrastructure. The development raises concerns about elevated crypto security and market-risk.

The stolen Bitcoin has been swapped into Ethereum via THORChain, with the transaction taking place on September 3, 2026. This incident highlights the potential risks of using hardware wallets and the importance of robust security measures to protect against such attacks.