Coldcard Exploit Victim Swaps Stolen Bitcoin for Ether via THORChain

A hacker linked to the third wave of Coldcard wallet thefts has begun converting stolen Bitcoin into Ether using the cross‑chain protocol THORChain. This is the first instance of funds from any of the three Coldcard theft waves moving on‑chain from the original hacker addresses.

Partial Conversion Through THORChain

Galaxy’s head of research, Alex Thorn, reported that about 10% of the stolen Bitcoin was swapped for Ether, while the remaining 90% stayed untouched. Thorn noted that the attacker encountered repeated refunds when attempting to complete the swaps, prompting multiple retry attempts.

Tracing the Ether Destination

On‑chain analysts followed the THORChain transactions to a newly created Ethereum address. Thorn shared this address with relevant authorities and cryptocurrency firms for further investigation.

Background on the Coldcard Theft

The Coldcard exploit, linked to the theft of at least 1,789 Bitcoin from 8,865 addresses (valued at roughly $114.7 million at the time of the breach), has been under scrutiny since August. Security firm CertiK previously reported that attackers associated with the exploit moved 64 Bitcoin and 200 Ether to mixers such as Tornado Cash.

Uncertain Next Steps

It remains unclear whether the hacker will attempt additional obfuscation or move the remaining assets through an exchange.