Coldcard hacker swaps 10% of stolen Bitcoin for Ether via THORChain
In brief
- Coldcard third-wave hacker swapped ~10% stolen Bitcoin to Ether via THORChain
- Attacker encountered technical issues with repeated refunds and retry attempts during swaps
- Converted funds traced to new Ethereum address by onchain analysts
- 90% of stolen funds remain untouched in original addresses
The Movement Begins
Onchain analysts traced the converted funds through THORChain to a new Ethereum address. The attacker's activity suggests a shift in strategy after months of dormancy. Thorn shared the new Ethereum address with relevant authorities and crypto companies, enabling broader surveillance of the stolen assets.
What's notable is the incomplete execution. The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying, according to Thorn. The repeated failures suggest the attacker may lack experience with cross-chain swaps or is working under time pressure.
Scale of the Theft
The Coldcard exploit resulted in the theft of at least 1,789 Bitcoin from 8,865 addresses, worth approximately $114.7 million at the time of theft. The three waves of attacks occurred over several months, affecting users across multiple geographies.
In August, hackers tied to the exploit had already moved some stolen crypto to privacy mixers. They sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash, signaling early attempts to obfuscate the trail. The latest THORChain activity represents a more direct approach.
What Comes Next
With 90% of the stolen funds still untouched, the attacker's next moves remain uncertain. It remains unclear whether the attacker will attempt to further obscure or move the assets through an exchange. The distribution of the Ethereum address to authorities may complicate any future movement through regulated channels, potentially forcing the attacker to rely further on decentralized swaps or mixers to cash out.
Frequently asked questions
What is the Coldcard exploit?
The Coldcard exploit refers to a series of wallet thefts affecting Coldcard hardware wallet users across three waves of attacks. The breach resulted in the theft of at least 1,789 Bitcoin from 8,865 addresses, worth approximately $114.7 million at the time of theft.
Why is the THORChain swap significant?
This marks the first time stolen funds from any of the three Coldcard waves moved onchain from the original hacker addresses. The movement suggests the attacker is actively attempting to convert and potentially cash out the stolen assets.
