Key facts
- A hacker associated with the third wave of Coldcard wallet thefts has moved approximately 10% of stolen Bitcoin.
- The funds were swapped for Ether using the THORChain decentralized exchange.
- On-chain analysts traced the Bitcoin to a new Ethereum address.
- The hacker reportedly faced difficulties in swapping all the stolen funds, with some transactions being refunded.
- This is the first instance of funds moving on-chain from the original hacker addresses related to this exploit.
A hacker implicated in the third wave of Coldcard wallet thefts has begun moving a portion of the stolen Bitcoin, swapping approximately 10% of the funds for Ether via the THORChain decentralized exchange. Alex Thorn, head of research at Galaxy, reported on X that the hacker is encountering difficulties in fully liquidating the assets, with some transactions being refunded. This marks the first on-chain movement of funds from the original hacker addresses associated with this exploit.
Onchain analysts have traced the Bitcoin, after its passage through THORChain, to a newly identified Ethereum address. Thorn stated that this information has been shared with relevant authorities and cryptocurrency companies. It remains uncertain if the attacker will attempt further obfuscation or utilize an exchange to move the assets.
The recent activity follows a significant Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, valued at approximately $114.7 million at the time of the theft. Earlier in August, blockchain security firm CertiK noted that hackers associated with the exploit had sent 64 Bitcoin and 200 Ether to cryptocurrency mixers like Tornado Cash.