Hacker Behind Coldcard Wallet Thefts Begins Moving Stolen Bitcoin Through THORChain

A hacker linked to the third wave of Coldcard wallet thefts has started swapping stolen Bitcoin for Ether through THORChain.

Galaxy head of research Alex Thorn took to X on Wednesday to report that the third-wave exploiter moved about 10% of the stolen funds, with 90% remaining untouched. Thorn said it marked the first time funds from any of the three waves had moved onchain from the original hacker addresses.

“The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” he said.

Thorn said onchain analysts traced the funds through THORChain to a new Ethereum address, adding that he shared it with relevant authorities and crypto companies. It remains unclear whether the attacker will attempt to further obscure or move the assets through an exchange, he added.

The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time they were stolen. Blockchain security company CertiK reported in August that hackers linked to the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.

The latest movement comes days after Thorn said the Coldcard attackers remained active, citing the Aug. 28 sweep of a deliberately weakened researcher wallet designed to test the attackers’ ability to find vulnerable keys.