Coldcard Thief Swaps Stolen Bitcoin for Ether Through THORChain
A hacker linked to the third wave of Coldcard wallet thefts has started moving stolen Bitcoin. The funds were transferred through THORChain, a cross-chain protocol that facilitates swaps between different assets.
The movement is the first onchain activity from any of the three theft waves, which saw over $114 million in Bitcoin stolen across 8,865 addresses. Galaxy Research head of research Alex Thorn reported the development, noting that about 20.5 Bitcoin was shifted, roughly 10% of the third wave's stolen coins.
The swaps through THORChain did not run smoothly, with about 17.7 Bitcoin being refunded during the attempts before the funds went through. The hacker appears to be experiencing issues swapping all the funds through THORChain, with Thorn stating that 'they keep getting refunded and he keeps retrying.'
The proceeds from the swaps have reached a new Ethereum address, which Galaxy has shared with law enforcement and major crypto firms.