Coldcard hacker moves stolen Bitcoin through THORChain

• A Coldcard attacker moved about 10% of stolen Bitcoin through THORChain into Ether.
• The movement was the first on-chain transfer from the original attacker addresses across three attack waves.
• Researchers are tracking the funds after the attacker encountered repeated failed swaps.

A hacker linked to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin (CRYPTO:BTC) through THORChain.

The attacker moved about 10% of the stolen funds, while roughly 90% remained at the original addresses, according to Galaxy Research.

The transfers marked the first on-chain movement from the original addresses linked to any of the three Coldcard attack waves, Galaxy head of research Alex Thorn said.

On-chain analysts traced the Bitcoin through THORChain to a new Ethereum (CRYPTO:ETH) address, which Thorn said had been shared with relevant authorities and crypto companies.

Thorn said the attacker appeared to have encountered problems completing the swaps, with some transactions refunded before being retried.

Galaxy Research linked the wider exploit to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about US$114.7 million when stolen.

The latest movement follows reports that hackers linked to the exploit had previously sent 64 Bitcoin and 200 Ether to crypto mixers, while Coldcard has advised affected users to migrate vulnerable wallet seeds.

At the time of reporting, Bitcoin price was $80,807.66.