Coldcard Hacker Swaps $11.5M in Stolen Bitcoin for ETH via THORChain

A hacker linked to the third wave of Coldcard wallet thefts has begun moving stolen funds onchain for the first time, swapping roughly 10% of the haul into Ether through cross-chain swap protocol THORChain. Galaxy head of research Alex Thorn reported the activity on X on Wednesday, noting that approximately 90% of the stolen Bitcoin remains untouched across the original hacker addresses. The onchain movements mark the first confirmed outbound transactions from any of the three exploit waves since the thefts occurred.

According to Thorn, the attacker encountered technical difficulties while executing swaps through THORChain, repeatedly receiving refunds and retrying the transactions before successfully routing funds to a new Ethereum address. Thorn confirmed that the receiving address has been shared with relevant authorities and crypto companies for potential intervention. It remains unclear whether the exploiter will attempt further obfuscation through mixing services or attempt to cash out through a centralized exchange.

The latest activity follows Galaxy Research's previous finding linking the Coldcard exploit to the theft of at least 1,789 Bitcoin from 8,865 addresses, valued at approximately $114.7 million at the time of the theft. Blockchain security firm CertiK reported in August that exploit-linked wallets had already sent 64 Bitcoin and 200 Ether to cryptocurrency mixers including Tornado Cash. The Coldcard attackers were confirmed to still be active days earlier, when they swept a deliberately weakened researcher wallet on August 28 designed to test the attackers' ability to identify vulnerable private keys.