A hacker linked to the third wave of Coldcard wallet thefts has begun moving stolen funds by swapping Bitcoin for Ether through THORChain, according to Galaxy Research.
Alex Thorn, Galaxy's head of research, reported on Wednesday that the attacker moved roughly 10% of the stolen funds, leaving 90% in the original addresses. This marks the first time assets from any of the three Coldcard theft waves have moved onchain from the hacker's original addresses.
Movement and Obstacles
Thorn noted that the hacker encountered difficulties executing the swaps through THORChain, describing repeated refunds and retry attempts. Onchain analysts traced the transferred funds to a new Ethereum address, which Thorn said was shared with relevant authorities and cryptocurrency companies.
It remains unclear whether the attacker plans to further obscure the assets or move them through an exchange.
Scale of the Breach
The recent activity follows a Coldcard exploit in which Galaxy Research identified the theft of at least 1,789 Bitcoin from 8,865 addresses, valued at approximately $114.7 million at the time of the theft. In August, blockchain security firm CertiK reported that hackers connected to the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers including Tornado Cash.
The latest fund movements come shortly after Thorn indicated the attackers remained active, citing an Aug. 28 sweep of a deliberately weakened researcher wallet designed to test the attackers' ability to locate vulnerable keys.
