Coldcard Hacker Swaps Stolen Bitcoin for Ethereum via THORChain

Detection of Stolen Funds Movement

On Wednesday, September 6, Alex Thorn reported on social media platform X that the hacker behind the third wave of Coldcard thefts attempted to swap about 10% of the stolen Bitcoins through the THORChain protocol, while the remaining 90% of the assets remain untouched.

Thorn highlighted that this is the first recorded on-chain movement of stolen funds from the hacker's original addresses across all three waves of attacks.

He also noted difficulties encountered by the hacker in swapping the entire amount through THORChain—operations were frequently refunded, and the attacker kept retrying.

The addresses and fund flow were traced by on-chain analysts and shared with relevant law enforcement agencies and crypto firms for further investigation.

Background of Coldcard Hacks and Scope of Losses

The thefts were linked to a vulnerability in Coldcard wallets uncovered in summer 2023. Galaxy Research estimated at least 1,789 Bitcoins stolen from 8,865 addresses, amounting to approximately $114.7 million at the time of theft.

In August, blockchain security firm CertiK reported that the hackers had sent some of the stolen assets—64 Bitcoins and 200 Ethers—to cryptocurrency mixers like Tornado Cash to obfuscate their trail.

Furthermore, Alex Thorn previously noted ongoing attacker activity: on August 28, they swept a deliberately weakened researcher wallet designed to test the hackers' ability to find vulnerable keys.