Coldcard hacker swaps stolen BTC for ETH via THORChain

A hacker linked to the third wave of Coldcard wallet thefts began converting stolen Bitcoin into Ether using the cross‑chain protocol THORChain on September 3. The activity involved roughly 10% of the Bitcoin under the attacker’s control, while the remaining 90% stayed at the original addresses.

Swap activity and technical issues

The attacker attempted multiple swaps on THORChain, but several transactions were refunded, forcing repeated submissions. The exact cause of the refunds was not confirmed, with possibilities including liquidity limits, transaction parameters, or protocol safeguards.

New Ethereum destination

Researchers traced the successful swaps to a newly identified Ethereum address. The address has been shared with law‑enforcement agencies, cryptocurrency companies, and monitoring organizations to track any subsequent movement of the Ether.

Background on the Coldcard breach

The theft stems from a vulnerability in Coldcard firmware released in 2021 that weakened seed randomness, allowing attackers to derive private keys remotely. Coinkite, the manufacturer, has issued corrected firmware but advises users with vulnerable seeds to generate new ones and migrate funds.

Broader context and next steps

Galaxy Research previously attributed 1,789.28 BTC across 8,865 addresses to the Coldcard vulnerability, valued at about $115 million at the time of theft. Earlier waves saw funds moved to mixers, but this is the first on‑chain cross‑chain swap detected. Analysts will monitor whether the Ether moves to centralized exchanges, bridges, or privacy services, which remain potential points for intervention.