Coldcard hacker swaps stolen Bitcoin for ETH via THORChain

A hacker linked to the third wave of Coldcard wallet thefts has started swapping stolen Bitcoin for Ether through THORChain.

“The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” he said.

Thorn said onchain analysts traced the funds through THORChain to a new Ethereum address, adding that he shared it with relevant authorities and crypto companies. It remains unclear whether the attacker will attempt to further obscure or move the assets through an exchange, he added.

The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time they were stolen. Blockchain security company CertiK reported in August that hackers linked to the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.