Coldcard hacker swaps stolen Bitcoin for Ether through THORChain

A hacker tied to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin into Ether using THORChain, according to onchain researchers. Galaxy head of research Alex Thorn said about 10% of the stolen funds have been moved so far, while most of the assets remain in the original hacker wallets. He added that this was the first observed onchain movement from any of the three theft waves. Thorn said the attacker appeared to have trouble completing the swaps, with some transfers being refunded and retried. Analysts traced the funds to a new Ethereum address, and the information was reportedly shared with authorities and crypto firms. The Coldcard exploit was previously linked to the theft of at least 1,789 bitcoin from 8,865 addresses, worth about $114.7 million at the time. Earlier reports also said the attackers had used mixers such as Tornado Cash.