Image Credit: Shutterstock
A hacker tied to the third major wave of Coldcard wallet thefts has started moving stolen Bitcoin through THORChain, converting part of the funds into Ether after leaving the original addresses untouched for about a month.
The September 3 activity is the first movement Galaxy Research has observed from the original attacker addresses associated with Coldcard’s three major theft waves. Most of the third-wave Bitcoin remains unmoved.
About 20.5 BTC Enters THORChain Swap Route
Galaxy Research traced approximately 20.5 BTC from third-wave addresses through a series of wallets before the funds reached THORChain, which allows users to exchange native assets between blockchains without using a centralized exchange.
Several BTC-to-ETH swap attempts resulted in portions of the Bitcoin being refunded through THORChain, followed by additional attempts.
On-chain tracking showed about 17.7 BTC was returned during the process, while an Ethereum address linked to the route received roughly 90.26 ETH. More than 90% of the Bitcoin attributed to the third wave remained in its original storage addresses during the observed activity.
Galaxy Traces 90.26 ETH to New Ethereum Address
Galaxy Research head Alex Thorn traced the converted funds to a new Ethereum address and shared the address with crypto companies and relevant authorities. The cross-chain transfers created additional publicly visible transaction paths across Bitcoin and Ethereum.
Other Coldcard-related stolen funds have previously moved through CoinJoin transactions, exchanges and interchain bridges. Galaxy said the September 3 activity was the first movement it had observed from the original addresses associated with the three major theft waves.
Coldcard Thefts Involved More Than 1,700 BTC
The thefts began on July 30 after attackers exploited weak seed generation in affected Coldcard firmware. The flaw reduced the randomness protecting some wallet seeds, allowing attackers to reconstruct private keys without physically accessing the hardware wallets.
Galaxy has traced high-confidence losses of more than 1,700 BTC across thousands of addresses, worth over $110 million when stolen.
Updating firmware does not repair a seed generated by vulnerable software. Users with affected single-signature wallets have been advised to create a new seed using corrected firmware and move their Bitcoin.
Most of the Bitcoin attributed to the third theft wave remained unmoved after the September 3 THORChain activity.
