The attacker linked to the third wave of Coldcard wallet thefts has moved roughly 10% of the stolen funds through THORChain and started converting Bitcoin into Ether.

A hacker associated with the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin away from the original attacker-controlled addresses, using THORChain to swap part of the funds into Ether (ETH).

The movement marks the first observed on-chain transfer from the original addresses associated with the three major waves of Coldcard thefts, according to Galaxy Research head Alex Thorn.

While approximately 10% of the funds have moved, around 90% remain untouched at the original addresses.

How Much Bitcoin Did the Coldcard Hacker Move?

Alex Thorn, head of research at Galaxy, reported that the attacker behind the third wave of Coldcard thefts moved approximately 10% of the stolen funds.

According to Thorn, around 90% of the funds remain untouched.

Blockchain analysts subsequently traced the movement through THORChain to a new Ethereum address.

Thorn said the discovery was shared with relevant authorities and cryptocurrency companies monitoring the stolen assets.

How THORChain Is Being Used to Move the Stolen Funds

THORChain is a decentralized cross-chain liquidity protocol that allows users to swap native assets across different blockchain networks without relying on a traditional centralized exchange.

In this case, the attacker appears to be using THORChain to move value from Bitcoin into Ether.

Cross-chain swaps can introduce additional layers to the transaction trail because assets move between different blockchain ecosystems. However, this does not make the funds inherently untraceable.

Blockchain transactions remain publicly observable, allowing analysts and law enforcement agencies to monitor the movement of assets across networks.

Failed THORChain Swaps Add Complexity

Not every attempted swap appears to have been successful.

Thorn said the attacker encountered problems while attempting to move all of the funds through THORChain, with some transactions reportedly being refunded before the attacker tried again.

Repeated swap attempts provide additional on-chain activity for researchers to analyze and may help investigators identify the attacker’s preferred routes for moving the stolen assets.

The Larger Coldcard Theft

The latest transactions are connected to a broader Coldcard-related theft campaign.

Galaxy Research previously linked the attacks to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth approximately $114.7 million at the time of the theft.

Earlier investigations also identified movements involving crypto mixing services, highlighting the continued efforts by attackers to obscure the origin and destination of stolen digital assets.

Will the Remaining Bitcoin Be Moved?

It remains unclear whether the attacker will eventually move the remaining funds.

At the time of the latest reports, approximately 90% of the third-wave funds remained at the original identified addresses.

The newly identified Ethereum address is now being monitored by blockchain researchers, cryptocurrency companies and relevant authorities.

Future transactions could provide additional clues if the assets are moved to centralized exchanges, bridges, privacy-focused protocols or other blockchain addresses.

Why the Coldcard Fund Movement Matters

The transaction is significant for the broader crypto market for several reasons.

First, the movement demonstrates how cross-chain liquidity infrastructure can be used to change the blockchain representation of potentially stolen assets.

Second, the use of THORChain highlights the role decentralized cross-chain protocols can play in the movement of digital assets across different networks.

Third, continued monitoring of the funds could provide investigators with additional information about how sophisticated crypto attackers attempt to move and potentially liquidate stolen assets.

However, converting Bitcoin into Ether does not necessarily mean the attacker has sold the assets. Further on-chain activity would be required to determine the final destination and purpose of the transferred ETH.

Conclusion

The hacker linked to the third wave of Coldcard thefts has started moving stolen Bitcoin through THORChain, converting part of the funds into Ether.

Approximately 10% of the stolen funds have moved, while around 90% remain at the original addresses.

Several swap attempts reportedly failed and were refunded, while blockchain researchers traced successful transactions to a newly identified Ethereum address.

With the address already shared with relevant authorities and crypto companies, the next movements of the stolen assets could provide important clues about the attacker’s strategy and the ultimate destination of the funds.

Key Takeaways

• The Coldcard attacker moved approximately 10% of the third-wave stolen funds.
• Part of the stolen BTC was swapped into ETH through THORChain.
• Around 90% of the funds remain untouched.
• Some THORChain swap attempts were reportedly refunded.
• Researchers traced the transactions to a new Ethereum address.
• The broader Coldcard theft campaign involved at least 1,789 BTC from 8,865 addresses.
• The stolen Bitcoin was worth approximately $114.7 million when the theft occurred.
• Further on-chain movements could provide additional clues about the attacker’s strategy.

source : cointelegraph.com