Coldcard Hacker Swaps Stolen Bitcoin for ETH via THORChain
Key Takeaways
- •The hacker moved approximately 10% of the stolen Bitcoin into Ether through THORChain, leaving 90% of the funds untouched.
- •This is the first onchain movement of funds from the original hacker addresses across all three waves of the Coldcard exploit, per Galaxy's Alex Thorn.
- •Galaxy Research linked the Coldcard exploit to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time of theft.
- •Analysts traced the swapped funds to a new Ethereum address, which Thorn shared with relevant authorities and crypto companies.
- •CertiK reported in August that exploit-linked hackers had sent 64 Bitcoin and 200 Ether to mixers such as Tornado Cash.
A hacker tied to the third wave of Coldcard wallet thefts has begun swapping stolen Bitcoin for Ether through THORChain, moving roughly 10% of the stolen funds while 90% remain untouched.
Coldcard is a hardware wallet marketed for air-gapped Bitcoin storage, and the repeated exploitation of its users has raised broader questions about supply-chain and seed-security risks in self-custody hardware.
Alex Thorn, head of research at Galaxy, reported the development on X on Wednesday. According to Thorn, this marks the first time funds from any of the three waves of the Coldcard exploit have moved onchain from the original hacker addresses.
THORChain is a cross-chain liquidity protocol that allows users to swap assets across different blockchains without a centralized intermediary, a feature that has made it a recurring venue for moving stolen crypto, as traced funds cannot be frozen by a single operator.
"The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying," Thorn said.
Thorn said onchain analysts traced the funds through THORChain to a new Ethereum address, and that he shared the address with relevant authorities and crypto companies. It remains unclear, he added, whether the attacker will attempt to further obscure or move the assets through an exchange.
The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth approximately $114.7 million at the time they were stolen.
Blockchain security firm CertiK reported in August that hackers connected to the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.
The latest movement comes days after Thorn said the Coldcard attackers remained active, citing the Aug. 28 sweep of a deliberately weakened researcher wallet that had been set up to test the attackers' ability to find vulnerable keys.
Related: Lazarus Group-linked addresses move $30M through Hyperliquid
