Coldcard hacker swaps $11 million Bitcoin for Ether through THORChain

Onchain transfers and THORChain activity

Alex Thorn, head of research at Galaxy, reported on X that the exploiter moved about 10% of the illicit funds to a new Ethereum address. Thorn stated that 90% of the Bitcoin taken during this attack remains unmoved in the original hacker-controlled wallets.

This recent transaction signals the first notable movement from the hacker’s addresses since the initial Coldcard attacks, according to Thorn. He noted that the hacker encountered technical difficulties during the process, as multiple attempted swaps through THORChain were refunded before succeeding.

The hacker appears to be encountering issues swapping all the funds through THORChain, with repeated attempts resulting in refunds, Alex Thorn said.

Expert onchain analysts have traced the transferred funds to a new Ethereum address, which has since been shared with relevant law enforcement and major crypto firms. There is uncertainty around whether the attacker will attempt further laundering steps, such as transferring assets through an exchange to obscure their origins.

Mini dictionary: THORChain, a cross-chain decentralized liquidity network that allows users to swap cryptocurrencies between different blockchains without relying on centralized exchanges.

Background on the Coldcard theft

Galaxy Research previously attributed a Coldcard exploit to the theft of at least 1,789 Bitcoin from 8,865 different wallet addresses. The stolen Bitcoin was valued at $114.7 million at the time of theft. Coldcard is a hardware wallet developed by Canadian company Coinkite, used by cryptocurrency holders to store Bitcoin securely offline.

The initial theft was discovered after blockchain security firm CertiK observed hackers linked to the exploit sending 64 Bitcoin and 200 Ether through cryptocurrency mixers, specifically Tornado Cash. Cryptocurrency mixers are services designed to obscure the transaction history of coins to improve privacy, but they are often used by cybercriminals to launder stolen assets.

Continued activity and security concerns

The transfer activity follows ongoing monitoring by blockchain researchers, who found that the hacker remained active as recently as late August. At that time, the attacker swept a deliberately weakened wallet set up by a researcher to test if the thief continued to scan for vulnerable keys.

The Coldcard security breach has heightened concerns in the cryptocurrency community, with observers watching to see if the stolen assets will undergo further laundering or ultimately enter mainstream exchanges.