A hacker tied to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin onchain, swapping part of the haul for Ether through THORChain. Galaxy Research head of research Alex Thorn said the exploiter moved roughly 10% of the stolen funds, while about 90% remains untouched. Thorn described the transfers as the first onchain movement from the original hacker addresses across all three waves of the Coldcard thefts.
According to Thorn, the attacker appears to be struggling to swap the full amount through THORChain, with transactions being refunded and retried. Onchain analysts traced the funds to a new Ethereum address, which Thorn said he shared with relevant authorities and crypto companies. He added that it is still unclear whether the attacker will try to further obscure the trail or move the assets through an exchange.
Galaxy Research previously linked the Coldcard exploit to the theft of at least 1,789 BTC from 8,865 addresses, worth about $114.7 million at the time of the theft. CertiK said in August that hackers connected to the exploit had also sent 64 BTC and 200 ETH to mixers including Tornado Cash.
A hacker linked to the third wave of Coldcard wallet thefts has started moving stolen Bitcoin onchain, using THORChain to swap part of the funds into Ether.
Galaxy Research head of research Alex Thorn said Wednesday on X that the third-wave exploiter had moved about 10% of the stolen funds, while roughly 90% remained untouched. He said this was the first time funds from any of the three waves had moved onchain from the original hacker addresses.
“The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” Thorn wrote.
Thorn said onchain analysts traced the assets through THORChain to a new Ethereum address. He added that he had shared that address with relevant authorities and crypto companies. It remains unclear whether the attacker will try to further obscure the funds or move them through an exchange, he said.
The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 BTC from 8,865 addresses, worth about $114.7 million at the time the assets were stolen.
Blockchain security firm CertiK said in August that hackers tied to the exploit had sent 64 BTC and 200 ETH to crypto mixers including Tornado Cash.
The latest movement came days after Thorn said the Coldcard attackers were still active. He pointed to the Aug. 28 sweep of a deliberately weakened researcher wallet that had been designed to test the attackers’ ability to find vulnerable keys.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
