A cybercriminal associated with the third wave of thefts from Coldcard wallets has started converting stolen Bitcoin into Ether using THORChain, a decentralized cross-chain liquidity protocol.
Onchain transfers and THORChain activity
Alex Thorn, head of research at Galaxy, reported on X that the exploiter moved about 10% of the illicit funds to a new Ethereum address. Thorn stated that 90% of the Bitcoin taken during this attack remains unmoved in the original hacker-controlled wallets.
This recent transaction signals the first notable movement from the hacker’s addresses since the initial Coldcard attacks, according to Thorn. He noted that the hacker encountered technical difficulties during the process, as multiple attempted swaps through THORChain were refunded before succeeding.
The hacker appears to be encountering issues swapping all the funds through THORChain, with repeated attempts resulting in refunds, Alex Thorn said.
Expert onchain analysts have traced the transferred funds to a new Ethereum address, which has since been shared with relevant law enforcement and major crypto firms. There is uncertainty around whether the attacker will attempt further laundering steps, such as transferring assets through an exchange to obscure their origins.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLMini dictionary: THORChain, a cross-chain decentralized liquidity network that allows users to swap cryptocurrencies between different blockchains without relying on centralized exchanges.
Background on the Coldcard theft
Galaxy Research previously attributed a Coldcard exploit to the theft of at least 1,789 Bitcoin from 8,865 different wallet addresses. The stolen Bitcoin was valued at $114.7 million at the time of theft. Coldcard is a hardware wallet developed by Canadian company Coinkite, used by cryptocurrency holders to store Bitcoin securely offline.
The initial theft was discovered after blockchain security firm CertiK observed hackers linked to the exploit sending 64 Bitcoin and 200 Ether through cryptocurrency mixers, specifically Tornado Cash. Cryptocurrency mixers are services designed to obscure the transaction history of coins to improve privacy, but they are often used by cybercriminals to launder stolen assets.
| Details | Value |
|---|---|
| Total Bitcoin stolen | 1,789 BTC |
| Number of affected addresses | 8,865 |
| Initial value of stolen assets | $114.7 million |
| Bitcoin mixed via Tornado Cash (August) | 64 BTC |
| Ether mixed via Tornado Cash (August) | 200 ETH |
| Percentage of funds moved (THORChain swap) | 10% |
| Percentage of funds remaining | 90% |
Continued activity and security concerns
The transfer activity follows ongoing monitoring by blockchain researchers, who found that the hacker remained active as recently as late August. At that time, the attacker swept a deliberately weakened wallet set up by a researcher to test if the thief continued to scan for vulnerable keys.
The Coldcard security breach has heightened concerns in the cryptocurrency community, with observers watching to see if the stolen assets will undergo further laundering or ultimately enter mainstream exchanges.
