- Coldcard hacker moves stolen BTC for the first time, ending a long period of inactivity.
- Attacker swaps Bitcoin to ETH via THORChain, shifting funds across blockchains.
- Cross-chain movement adds complexity as investigators track stolen funds beyond Bitcoin.
The Coldcard hacker has moved stolen Bitcoin from the Wave 3 attack for the first time, ending a period in which the funds remained dormant in the original attacker-controlled addresses.
Galaxy Digital research head Alex Thorn reported that the exploiter transferred part of the stolen BTC and swapped it into Ethereum through THORChain, marking the first known movement directly from the original hacker addresses linked to Waves 1, 2, or 3.
The transactions mark a shift from earlier behavior, where the stolen Bitcoin remained untouched. The attacker has now begun moving funds across blockchains, offering the first clear indication of how the assets may be laundered beyond the original wallets.
Coldcard Hacker Moves BTC Through THORChain
Thorn said the Wave 3 exploiter used THORChain, a cross-chain decentralized exchange protocol, to swap stolen Bitcoin for native ETH.
The THORChain deposits carried an OP_RETURN memo and an affiliate tag of “sto” set at zero basis points. Thorn also identified differences between the software used for these transactions and the wallets associated with the July and August sweeps.
The later transactions signaled replace-by-fee, used a recent locktime, and paid higher transaction fees. Meanwhile, the first spend from Wave 3 revealed a 2-of-2 multisignature setup, with later transfers using the same structure but with different keys.
Cross-Chain Swap Adds Another Layer to Fund Tracing
Moving BTC through THORChain and receiving ETH shifts the transaction trail from Bitcoin to Ethereum. As a result, investigators must connect activity across separate blockchains while following new destination addresses and subsequent transfers.
Thorn and other researchers are continuing to trace the transactions. Further movement could reveal whether the attacker sends the ETH to additional wallets, conducts more swaps, or transfers funds toward cryptocurrency exchanges. Most of the stolen Wave 3 Bitcoin, however, remains in the original vaults.
Related: Coldcard Deploys Major Firmware Upgrade Following Seed Attack
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
