Coldcard hacker swaps stolen Bitcoin for ETH via THORChain

A hacker linked to the third wave of Coldcard wallet exploits has initiated onchain transactions, swapping stolen Bitcoin for Ether using the decentralized cross-chain protocol THORChain. According to Alex Thorn, head of research at Galaxy, the exploiter has moved roughly 10% of the stolen funds, while approximately 90% remains untouched in original hacker addresses. This marks the first time funds from any of the three exploit waves have been moved onchain from their initial resting addresses. Onchain analysts tracked the swapped assets to a newly created Ethereum address, with details subsequently shared with relevant authorities and security firms. Thorn noted that the attacker experienced friction during the process, encountering multiple transaction refunds on THORChain before successfully executing trades. The underlying security incident previously resulted in the theft of at least 1,789 Bitcoin across 8,865 addresses, valued at approximately $114.7 million at the time of the breach.