Coldcard hacker swaps stolen Bitcoin for Ether through THORChain

A hacker linked to the third wave of Coldcard thefts started swapping stolen Bitcoin for Ether through THORChain. Galaxy head of research Alex Thorn said the hacker moved about 10% of the stolen funds. The remaining 90% stayed untouched. Thorn said this was the first onchain movement from the original hacker addresses in any of the three waves. The hacker appeared to have problems completing the swaps because THORChain repeatedly refunded the funds. Thorn said the hacker kept retrying. Onchain analysts traced the funds through THORChain to a new Ethereum address. Thorn said he shared the address with relevant authorities and crypto companies. Thorn said it remained unclear whether the attacker would further obscure the assets or move them through an exchange. Galaxy Research linked the Coldcard exploit to the theft of at least 1,789 Bitcoin from 8,865 addresses. The stolen Bitcoin was worth about $114.7 million when it was taken. CertiK reported in August that hackers linked to the exploit had sent 64 Bitcoin to cryptocurrency mixers such as Tornado Cash. The hackers had also sent 200 Ether to the mixers. The latest movement came days after Thorn said the Coldcard attackers remained active. Thorn cited the Aug. 28 sweep of a deliberately weakened researcher wallet. The wallet was designed to test the attackers' ability to find vulnerable keys.