An attacker tied to a Coldcard-related Bitcoin theft has reportedly moved approximately 10% of the stolen BTC through THORChain, a cross-chain liquidity protocol. The maneuver complicates on-chain tracing efforts and has renewed scrutiny of how self-custody funds are laundered once they leave a hardware wallet.

The routing choice is significant because THORChain allows users to swap native assets across blockchains without a custodial intermediary. Stolen Bitcoin can therefore be converted into other tokens without ever passing through a centralized exchange that might freeze the funds. That mechanic is precisely why the protocol continues to surface in fund-tracing cases involving self-custody breaches. Cross-chain crime of this kind has grown into an industry-wide concern: blockchain analytics firms such as Chainalysis have tracked billions of dollars in stolen funds moving through cross-chain bridges and swap protocols in recent years, and on-chain investigators, including ZachXBT, have previously linked THORChain usage to high-profile thefts attributed to North Korea's Lazarus Group. For related coverage, see Bitcoin Hits $82,000 After Fed Dovish Signals as Ethereum, XRP, Dogecoin Jump.

Key points

• An attacker in a Coldcard-linked theft reportedly moved about 10% of the stolen Bitcoin through THORChain.
• THORChain's cross-chain swaps let value exit into other assets without a custodial chokepoint, making the funds harder to follow.
• The report remains partly unconfirmed, and only a fraction of the stolen BTC has been traced through the protocol so far.

The incident follows earlier reporting of Coldcard-related losses. AICryptoCore previously covered how Coldcard faced a suspected fourth attack wave involving about 388.9 BTC, part of a broader pattern of hardware-wallet users being targeted through supply-chain or seed-compromise vectors. That pattern sits within a larger trend in which stolen crypto has hit record annual totals, according to industry incident trackers, putting pressure on both device makers and investigators. For related coverage, see Bitcoin Miner Leaves Mine Site for AI Deal Worth Up to $1.2 Billion.

Why moving only part of the stolen BTC still matters

Even a partial transfer carries weight for investigators. Swapping a small portion first is a common laundering test: it lets an attacker gauge whether liquidity, slippage, and monitoring responses will allow the remainder to follow without triggering freezes or alerts. For related coverage, see Bitcoin Back Above $77,500 as XRP Leads Majors on Lower Fed Hike Odds.

Because THORChain settles into native assets on destination chains, portions of the proceeds can land as Ethereum-based tokens, where movements remain visible on public explorers such as Ethereum blockchain records. That visibility is the double edge of cross-chain swaps: they obscure the direct BTC trail but leave a new, traceable footprint on the receiving chain.

What it means for wallet security and tracing

For self-custody users, the takeaway is operational rather than theoretical. Once a seed or signing device is compromised, on-chain speed favors the attacker, and cross-chain routing shrinks the window for exchanges or law enforcement to intervene. The same AI-assisted monitoring now used to defend wallets is increasingly being applied to trace laundering flows across chains.

That convergence is visible elsewhere in the security stack. AICryptoCore has reported on how a Bitcoin red team used Kimi AI to hunt for potential flaws, an example of machine-driven analysis being applied to both offense and defense in Bitcoin infrastructure.

The details of this case remain partly unconfirmed, and the share of stolen funds routed through the protocol could shift as more of the trail is mapped. For decentralized-AI and on-chain analytics teams, incidents like this are becoming a primary benchmark for cross-chain forensic tooling, where the contest is increasingly model-versus-mixer rather than analyst-versus-transaction.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.