Coldcard Thief Exchanges Bitcoin for Ethereum Through THORChain

The attacker behind the third major Coldcard attack wave has finally moved some of the stolen Bitcoin, swapping it for Ethereum through THORChain.

About 4.2 BTC was converted into approximately 135 ETH as the attacker experimented with different routes through the cross-chain liquidity protocol.

Despite multiple attempted swaps being refunded before being retried, the resulting ETH was tracked to a newly created Ethereum address, which has been shared with exchanges and law-enforcement investigators.

The broader Coldcard compromise resulted from faulty firmware introduced in March 2021, which led to at least 1,778.84 BTC being stolen from over 8,600 addresses by mid-August.