Coldcard Exploiter Routes 10% Of Stolen Funds Into Ether Via THORChain

Galaxy research head Alex Thorn said the exploiter linked to the third wave of Coldcard thefts has started moving stolen Bitcoin for the first time, swapping part of the funds into Ether through THORChain. Thorn estimated that roughly 10% has moved while about 90% remains untouched, making the transfers the first observed on-chain movement from the original hacker addresses across any of the three waves.

COLDCARD WAVE 3 HACKER SWAPS FUNDS TO ETH VIA THORCHAIN

the wave 3 exploiter has moved stolen funds for the first time, swapping to ETH them through the THORChain cross-chain DEX

these are the first funds from wave 1, 2, or 3 to move onchain from the original hacker addresses pic.twitter.com/jjOrX5wBR9

- Alex Thorn (@intangiblecoins) September 2, 2026

The attacker has reportedly encountered friction while using THORChain, with some swap attempts being refunded and retried. Even so, researchers were able to trace the routed funds to a new Ethereum address, showing that the cross-chain swaps have not eliminated visibility into the movement of the stolen assets.

… Continue reading the full article at the original source below.