Coldcard Bitcoin theft: hacker moves 10% of $114.7M, 90% still untouched

A hacker behind one of the largest hardware wallet exploits in recent memory just made a move that onchain investigators had been waiting months to see. According to blockchain researchers, the person responsible for the third wave of the Coldcard Bitcoin theft has finally started shifting stolen funds, sending roughly 10% of the loot through THORChain into a freshly created Ethereum address. It’s a small slice of a much bigger pile, but it’s the first sign of movement since the theft happened.

Key takeaways

• The Coldcard hacker moved about 10% of stolen Bitcoin through THORChain to a new Ethereum address, while 90% remains untouched.
• Galaxy’s head of research, Alex Thorn, flagged the transfer on X, calling it the first onchain movement from the original hacker addresses.
• The exploit is tied to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth roughly $114.7 million at the time it was stolen.
• The hacker is reportedly struggling to swap all the funds through THORChain, repeatedly getting refunded and retrying the transactions.
• Authorities and crypto companies have already been given the new Ethereum address, and the attackers remain active, having tested a weakened researcher wallet on August 28.

Partial Movement of Stolen Coldcard Bitcoin via THORChain

The person or group behind the third wave of the Coldcard Bitcoin theft has begun cashing out, but only in fragments. Galaxy’s head of research, Alex Thorn, reported on X Wednesday that the exploiter moved about 10% of the stolen funds while leaving the remaining 90% sitting untouched on the original addresses. That detail matters because it’s the first time any of the three waves tied to this exploit have shown onchain activity since the funds were first drained.

Tracing the 10% Funds Movement

Onchain analysts followed the trail through THORChain, a decentralized cross-chain swap protocol, and landed on a brand-new Ethereum address. That’s a meaningful clue for investigators, since it gives them a fresh target to monitor going forward. Thorn noted that it’s still unclear whether the attacker will try to obscure the assets further or eventually route them through a centralized exchange, where identity checks could expose the person behind the wallet.

Challenges Faced by the Hacker in Swapping Assets

Not everything is going smoothly for the thief, though. “The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” Thorn said. Those repeated refunds suggest some kind of friction in the swap process, whether from liquidity limits, network congestion, or something else entirely. Either way, it’s slowing down what would otherwise be a straightforward cash-out.

Scale and Status of the Coldcard Theft

The numbers behind this exploit are staggering even by crypto standards. Galaxy Research has linked the broader incident to the theft of at least 1,789 Bitcoin pulled from 8,865 addresses, worth roughly $114.7 million at the time the funds disappeared. With only about 10% now in motion, the vast majority of that fortune, 90%, is still parked exactly where the hacker first stashed it.

Total Stolen Cryptocurrency and Address Count

The sheer scale of affected wallets, nearly 9,000 addresses, points to a systemic vulnerability rather than an isolated case of a single victim losing funds. That kind of breadth is part of why the case has drawn sustained attention from researchers tracking every onchain wallet related to the exploit.

Mixer Transactions and Previous Attempts to Obscure Funds

This isn’t the first time hackers connected to the exploit tried to launder proceeds. Blockchain security firm CertiK reported back in August that hackers tied to the Coldcard incident had already funneled 64 Bitcoin and 200 Ether into cryptocurrency mixers such as Tornado Cash. That earlier activity shows a pattern of attempts to break the trail between stolen funds and their eventual destination, even before this latest THORChain transfer surfaced.

Investigation and Response Efforts

Investigators aren’t just watching from the sidelines. Once the new Ethereum address surfaced, Thorn said he shared it directly with relevant authorities and crypto companies, giving them a concrete lead to monitor for further activity or eventual exchange deposits. This kind of rapid information-sharing is often what determines whether stolen funds can be frozen before they’re fully cashed out.

Tracing and Sharing New Ethereum Address with Authorities

Why does this matter? Because the moment stolen crypto touches a new address, it becomes a fresh point of leverage for law enforcement and exchanges to flag and block. Sharing that address early gives compliance teams a chance to intercept funds before they reach a cash-out point, something that becomes far harder once assets are further mixed or split across multiple chains.

Recent Active Attacks by Hackers Targeting Researcher Wallets

The attackers behind the Coldcard exploit haven’t gone quiet in the meantime. Just days before this latest transfer, Thorn pointed to an August 28 sweep of a deliberately weakened researcher wallet, a decoy designed to test whether the attackers could still find and exploit vulnerable private keys. The fact that they took the bait suggests the group is still actively probing for opportunities, not simply sitting on stolen funds and waiting.

Why This Case Keeps Drawing Attention

The Coldcard Bitcoin theft has become something of a test case for how blockchain tracing tools hold up against determined attackers using tools like THORChain to bridge between networks. Every partial movement, every refund, every new address gives researchers another data point, and every data point narrows the space the hacker has left to operate undetected. With 90% of the stolen funds still sitting untouched, the bigger question isn’t whether this attacker will try to move the rest, it’s whether the next attempt gives investigators the break they’re looking for.

FAQ

How much of the stolen Bitcoin has the Coldcard hacker moved so far?

About 10% of the stolen Bitcoin has been moved through THORChain to a new Ethereum address, while 90% remain untouched on original hacker addresses.

What issues is the hacker facing in moving the stolen funds?

The hacker is having difficulties swapping all the funds through THORChain, repeatedly getting refunds and retrying.

What has been done by authorities or researchers regarding the stolen funds?

Galaxy shared the new Ethereum address associated with the moved funds with relevant authorities and crypto companies.

Are the Coldcard hackers still active?

Yes, they remain active and recently targeted a deliberately weakened researcher wallet on August 28.

{"@context":"","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How much of the stolen Bitcoin has the Coldcard hacker moved so far?","acceptedAnswer":{"@type":"Answer","text":"About 10% of the stolen Bitcoin has been moved through THORChain to a new Ethereum address, while 90% remain untouched on original hacker addresses."}},{"@type":"Question","name":"What issues is the hacker facing in moving the stolen funds?","acceptedAnswer":{"@type":"Answer","text":"The hacker is having difficulties swapping all the funds through THORChain, repeatedly getting refunds and retrying."}},{"@type":"Question","name":"What has been done by authorities or researchers regarding the stolen funds?","acceptedAnswer":{"@type":"Answer","text":"Galaxy shared the new Ethereum address associated with the moved funds with relevant authorities and crypto companies."}},{"@type":"Question","name":"Are the Coldcard hackers still active?","acceptedAnswer":{"@type":"Answer","text":"Yes, they remain active and recently targeted a deliberately weakened researcher wallet on August 28."}}]}

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.