Galaxy

Tornado

Read

THORChain

Expand

A hacker tied to <a href="https://yellow.com/news/coldcard-loses-70m-cz-warning" rel="noopener noreferrer nofollow">Coldcard’s third theft</a> wave moved about 10% of stolen Bitcoin<a href="https://yellow.com/asset/btc" rel="noopener noreferrer nofollow">(BTC)</a> through THORChain into Ether<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a>, creating a new Ethereum trail while 90% remains untouched.<h2 id="key-points">Key Points:</h2><blockquote><ul><li>The movement marks the first observed transfer from original hacker addresses across the three confirmed Coldcard theft waves.</li><li>Onchain analysts followed the assets through THORChain to a new Ethereum address.</li><li>Most of the third-wave funds have not moved.</li></ul></blockquote><h2 id="bitcoin-fund-movements">Bitcoin Fund Movements</h2>Galaxy head of research Alex Thorn<a href="https://cointelegraph.com/news/coldcard-hacker-swaps-stolen-bitcoin-eth-thorchain" rel="noopener noreferrer nofollow">said</a> the attacker had begun swapping stolen Bitcoin for Ether, while repeated failures were forcing several transactions to be retried. It was the first time funds from the original addresses used in any of the three waves had moved onchain.“The hacker appears to be having some issues swapping all the funds through THORChain ... they keep getting refunded and he keeps retrying,” Thorn said.The repeated refunds did not stop the attacker from continuing attempts to move the assets.Thorn said analysts traced the swaps to a new Ethereum address and shared it with relevant authorities and crypto companies, preserving a usable trail after the cross-chain transfers.Also Read:<a href="https://yellow.com/news/ukraine-1m-crypto-scam-wallets" rel="noopener noreferrer nofollow">Ukraine Exposes $1M Crypto Scam That Drained Wallets Across 20 Countries</a><h2 id="alex-thorn-analysis">Alex Thorn Analysis</h2>Thorn said it remained unclear whether the attacker would try to obscure the funds further or send them to an exchange, leaving investigators to watch how the newly identified Ethereum address is used. That question has become more important now that the original theft addresses are no longer completely dormant.Even after the THORChain swaps, analysts identified the destination on Ethereum, showing that moving between networks did not immediately sever the visible transaction path in this case.Thorn’s disclosure also gives exchanges and compliance teams another address to watch for activity tied to the stolen funds.Galaxy Research previously linked the Coldcard exploit to at least 1,789 Bitcoin taken from 8,865 addresses, worth about $114.7 million when stolen. Its Aug. 25 update said 1,561 Bitcoin, or 87.3% of the attributed losses, remained unspent at that point.Earlier Coldcard-linked activity had already reached privacy tools, with CertiK reporting in August that 64 Bitcoin and 200 Ether were sent to mixers including Tornado Cash. On Aug. 28, researchers also saw attackers sweep a deliberately weakened test wallet, indicating the operation was still active before the latest movement.Read Next:<a href="https://yellow.com/news/nvidia-hugging-face-ai-software-expansion" rel="noopener noreferrer nofollow">Nvidia Buys Hugging Face For $12.9B To Expand Beyond AI Chips</a>

Coldcard Hacker Tests THORChain Route As 10% Of Stolen Funds Move

Table of Contents

Yellow News

Other articles published on Sep 3, 2026

Pons And Flork Explode After Binance Alpha Listing

Standard Chartered Brings Bitcoin And Ether Trading to UAE Institutions

Nvidia buys Hugging Face for $12.9B in push into AI software

Bitcoin flashes crash warning as 'Bart Simpson' pattern returns

Pons Price Prediction: Why Price is Up 17% Today, Reason & 10x Growth?

Tether Sued USDT Freeze: Thai Businessmen Demand $42.4M Return

Join our free newsletter for daily crypto updates!