Stolen Bitcoin from the third wave of the Coldcard wallet attacks has begun leaving the hacker’s original addresses, with part of the holdings being swapped into Ethereum through THORChain.
The movement is the first recorded departure of funds from the original attacker addresses across any of the three waves, according to Alex Thorn, Galaxy’s head of research. Thorn said Wednesday that the third-wave attacker had moved about 10% of the stolen holdings, leaving roughly 90% untouched.
Several attempts to convert the assets have not gone through as intended. Thorn said the attacker’s swap attempts through THORChain had repeatedly resulted in refunds, prompting further attempts.
Researchers following the activity on-chain were able to trace the transfers beyond THORChain to a fresh Ethereum address. Thorn said the address had been passed to relevant authorities and crypto companies. He also said the attacker’s next step remained uncertain, including whether the assets would be moved again to make them harder to follow or transferred to an exchange.
Coldcard Attackers Remain Active
The latest transfers follow a broader Coldcard exploit that Galaxy Research has linked to the loss of at least 1,789 Bitcoin across 8,865 addresses. Those assets were valued at approximately $114.7 million when they were stolen.
Blockchain security company CertiK had also reported activity involving funds associated with the exploit in August, when 64 Bitcoin and 200 Ether were sent to cryptocurrency mixers, including Tornado Cash.
The latest movement comes days after Thorn reported further evidence that the Coldcard attackers remained active. A deliberately weakened wallet set up by a researcher was swept on Aug. 28. The wallet was designed to determine whether the attackers could locate vulnerable keys.