Coldcard Attack-Linked Funds Move to Tornado Cash After Two 200 ETH Transfers

Key Point

Two 200 ETH transactions linked to the Coldcard attack incident were sent to Tornado Cash. The funds were first bridged from BTC to an ETH address starting with 0x41B7 via THORChain. The transfers show that attack-linked funds moved across chains before entering a mixer.

Market Sentiment

Bearish, Event-driven, De-risking.

Reason: Attack-linked ETH moved to Tornado Cash, which may reduce recovery visibility and increase risk controls around related flows.

Similar Past Cases

This type of stolen-fund movement typically increases tracing complexity after funds enter a mixer. The difference is that this case also included a BTC-to-ETH bridge step before the mixer transfer.

Ripple Effect

Cross-chain movement can make incident response harder because funds may leave the original asset trail before compliance teams complete screening. If more attack-linked funds use bridges or mixers, then venues may increase scrutiny of related wallet activity.

Opportunities & Risks

Opportunities: Monitoring wallets tied to the 0x41B7 address may help traders assess whether more attack-linked funds are moving across chains.

Risks: Further mixer transfers could increase recovery risk and make related flows harder for exchanges and investigators to identify.