Coldcard hacker swaps stolen Bitcoin for ETH via THORChain
Summary
A hacker tied to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin into Ether via THORChain. About 10% of the stolen funds were swapped, while 90% remain untouched, and this is the first onchain movement from the original hacker addresses across any of the three waves. The swaps appear to be failing repeatedly, with refunds and retries. Analysts traced the funds through THORChain to a new Ethereum address and shared it with authorities and crypto firms. The Coldcard exploit is linked to at least 1,789 BTC stolen from 8,865 addresses, worth about $114.7 million at the time. Earlier, related hackers also moved funds through mixers like Tornado Cash.
