Coldcard Bitcoin theft: hacker moves 10% of $114.7M, 90% still untouched
A hacker behind one of the largest hardware wallet exploits in recent memory just made a move that onchain investigators had been waiting months to see. According to blockchain researchers, the person responsible for the third wave of the Coldcard Bitcoin theft has finally started shifting stolen funds, sending roughly 10% of the loot through THORChain into a freshly created Ethereum address. It’s a small slice of a much bigger pile, but it’s the first sign of movement since the theft happened.
Key takeaways
- The Coldcard hacker moved about 10% of stolen Bitcoin through THORChain to a new Ethereum address, while 90% remains untouched.
- Galaxy’s head of research, Alex Thorn, flagged the transfer on X, calling it the first onchain movement from the original hacker addresses.
- The exploit is tied to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth roughly $114.7 million at the time it was stolen.
- The hacker is reportedly struggling to swap all the funds through THORChain, repeatedly getting refunded and retrying the transactions.
- Authorities and crypto companies have already been given the new Ethereum address, and the attackers remain active, having tested a weakened researcher wallet on August 28.
Partial Movement of Stolen Coldcard Bitcoin via THORChain
The person or group behind the third wave of the Coldcard Bitcoin theft has begun cashing out, but only in fragments. Galaxy’s head of research, Alex Thorn, reported on X Wednesday that the exploiter moved about 10% of the stolen funds while leaving the remaining 90% sitting untouched on the original addresses. That detail matters because it’s the first time any of the three waves tied to this exploit have shown onchain activity since the funds were first drained.
… Continue reading the full article at the original source below.
