The Crypto Basic

Stolen Bitcoin from the third wave of the Coldcard wallet attacks has begun leaving the hacker’s original addresses, with part of the holdings being swapped into Ethereum through THORChain.

The movement is the first recorded departure of funds from the original attacker addresses across any of the three waves, according to Alex Thorn, Galaxy’s head of research. Thorn said Wednesday that the third-wave attacker had moved about 10% of the stolen holdings, leaving roughly 90% untouched.

Several attempts to convert the assets have not gone through as intended. Thorn said the attacker’s swap attempts through THORChain had repeatedly resulted in refunds, prompting further attempts.

Researchers following the activity on-chain were able to trace the transfers beyond THORChain to a fresh Ethereum address. Thorn said the address had been passed to relevant authorities and crypto companies. He also said the attacker’s next step remained uncertain, including whether the assets would be moved again to make them harder to follow or transferred to an exchange.

Coldcard Attackers Remain Active

The latest transfers follow a broader Coldcard exploit that Galaxy Research has linked to the loss of at least 1,789 Bitcoin across 8,865 addresses. Those assets were valued at approximately $114.7 million when they were stolen.

Blockchain security company CertiK had also reported activity involving funds associated with the exploit in August, when 64 Bitcoin and 200 Ether were sent to cryptocurrency mixers, including Tornado Cash.

The latest movement comes days after Thorn reported further evidence that the Coldcard attackers remained active. A deliberately weakened wallet set up by a researcher was swept on Aug. 28. The wallet was designed to determine whether the attackers could locate vulnerable keys.

The US state of Wyoming is adding Chainlink-based reserve monitoring to its Frontier Stable Token, giving users access to verified on-chain data about the assets supporting FRNT with minimal reporting delay. The move further broadens Chainlink’s role in the state-issued stablecoin.

According to a Wednesday announcement from the Wyoming Stable Token Commission, the state has selected Chainlink’s Proof of Reserve technology to put verified data on FRNT’s reserves and circulating supply onchain. The Network Firm will independently examine the figures before the data is transmitted through Chainlink infrastructure.

The commission is seeking an additional safeguard through Chainlink’s Secure Mint feature. Once adopted, the mechanism would prevent the creation of new FRNT unless verified reserves are equal to or greater than the token’s total supply. 

Those measures build on Wyoming’s existing reserve-reporting process. FRNT already has daily reserve attestations, while the GENIUS Act calls for monthly disclosures covering reserve composition and outstanding stablecoin supply. The commission said Proof of Reserve will provide more timely visibility into movements in the token’s backing between reporting periods.

Wyoming launched FRNT in January with backing from U.S. dollars and short-term U.S. Treasurys. Interest generated by those reserves is deposited into the state’s School Foundation Program. 

The latest reserve initiative comes roughly a fortnight after Wyoming broadened its use of Chainlink for FRNT. The state moved the token away from LayerZero and onto Chainlink’s Cross-Chain Interoperability Protocol, with CCIP taking over as the exclusive system supporting FRNT’s cross-chain operations.

Chainlink Expands Financial-Market Integrations

Beyond FRNT, Chainlink has been extending its technology across tokenized securities and traditional financial infrastructure, with integrations involving Coinbase, the Depository Trust and Clearing Corporation (DTCC), and Fidelity International.

For Coinbase’s B20 tokenized equities, launched on Base in August, Chainlink supplies pricing data covering stocks including Apple, Meta, Nvidia, and Alphabet. Decentralized finance (DeFi) protocols can use those feeds to value the tokens for trading, lending, and collateral. 

Chainlink is also being incorporated into traditional market infrastructure. In May, DTCC said it planned to use the technology for a platform designed to handle tokenized collateral around the clock. Fidelity International unveiled a tokenized liquidity fund during the same month, using infrastructure from Chainlink and Sygnum, while JPMorgan supplies daily net asset value data for pricing.

The oracle network joined Project Pangea in June alongside European and South Korean banking groups. The project is exploring atomic foreign-exchange settlement between the two regions using regulated stablecoins denominated in euros and won.

LINK, Chainlink’s native token, was trading around $11.20 on Thursday after gaining more than 37% over the past month, according to CoinGecko. 

Coinbase is expanding its Canadian product lineup with futures contracts offering leverage of as much as 10x, extending a broader push by US trading companies into the country’s digital-asset market.

Eligible Canadian clients can trade 23 perpetual and dated cryptocurrency futures covering Bitcoin (BTC), Ethereum (ETH), Solana (SOL) and other assets. Coinbase said Wednesday that its derivatives lineup also includes five commodity futures and the Coinbase 50 Index, with contracts available in nano-sized positions. 

Trading is provided by Coinbase Financial Markets, which is registered with the US Commodity Futures Trading Commission (CFTC) as a futures commission merchant. In Canada, the entity operates using foreign dealer and futures commission merchant exemptions.

The products are not available to all Canadian customers. Access includes investors with net financial assets of at least $5 million, along with registered investment advisers and dealers. Coinbase said it is the first major crypto-native platform to directly provide native crypto futures in the country. 

US Trading Firms Build Out Canadian Crypto Operations

Coinbase’s derivatives expansion follows other moves by US trading companies to broaden their cryptocurrency operations in Canada, including Webull’s addition of crypto trading this week and Robinhood’s acquisition of WonderFi earlier this year.

Webull made digital assets available to Canadian customers on Monday, adding crypto to a product lineup that already included stocks, exchange-traded funds (ETFs) and options. The online brokerage is relying on Coinbase infrastructure for cryptocurrency trading and custody. 

The expansion comes as cryptocurrency ownership in Canada has increased. Ontario Securities Commission research put ownership at 25% this year, up from 10% in 2023, a trend Webull cited as one factor behind its move into the market.

Robinhood took a different route into Canada, acquiring local crypto company WonderFi for US$180 million in June. The transaction brought exchanges Bitbuy and Coinsquare under Robinhood and added about 300,000 funded customers, along with WonderFi’s Canadian licenses and regulatory approvals.

The US Justice Department said an international operation involving European law enforcement and private-sector partners disrupted Sality’s operations, cutting the malware network off from its operator. Sality had been linked to cryptocurrency theft and other cyberattacks.

The Justice Department said Tuesday that authorities in Bulgaria, Hungary and Romania participated in the effort alongside CrowdStrike and the Shadowserver Foundation. According to US officials, the malware network had been infecting devices and deploying malicious software since 2003.

EggJagger Redirected Crypto Payments

Over the previous eight years, Sality’s operator used a clipjacking tool known as EggJagger to steal at least 12.1 million rubles, equivalent to roughly $150,000 in cryptocurrency, according to CrowdStrike.

EggJagger monitored device clipboards for cryptocurrency wallet addresses and replaced them with addresses controlled by the operator. As a result, payments could be redirected when victims copied Bitcoin or Ethereum addresses before making transfers.

CrowdStrike said the value of stolen digital assets that remained unspent peaked at about 147 million rubles, or roughly $1.35 million, in January 2025.

Disruption Cuts Operator Off From Infected Computers

The operation severed the Sality operator’s ability to communicate with compromised machines, according to CrowdStrike.

More than 15,000 infected computers were part of Sality’s peer-to-peer botnet. The bots checked every 40 minutes whether known peers remained online, allowing machines within the decentralized network to communicate directly with one another.

CrowdStrike said the disruption isolated those infected machines from the operator, preventing them from receiving new payload instructions or direct payload transfers.

Hyperscale Data has shut down Bitcoin mining at its Michigan facility to make way for an AI data center customer, with the company’s BTC holdings now about 79% below the level cited in late July.

The company said Wednesday that it shut down all miners at the site following an inspection by the unidentified California-based neocloud provider. The company intends to sell the mining equipment associated with the Michigan operation.

The shutdown advances Hyperscale’s plan to convert the facility from Bitcoin mining to AI infrastructure. Its customer has committed to 20 megawatts of computing capacity under a master services agreement with an initial 10-year term and two optional five-year extensions.

Hyperscale estimates that the agreement could generate more than $1.2 billion in revenue if the customer exercises both extensions, taking the contract to its maximum 20-year term. The customer also has an option for another 32 MW, which could push total contract revenue above $3 billion if exercised and maintained through the extensions.

Hyperscale said the planned expansion has not been finalized and remains subject to funding, regulatory clearances, and other uncertainties. The company ultimately expects the Michigan site to support about 340 MW of power capacity.

Bitcoin Sales Help Fund Michigan Conversion

Hyperscale is partly financing the Michigan redevelopment by drawing down its Bitcoin treasury.

The company reported holdings of about 1,006 BTC on July 30, when it had also sold 100 BTC. Hyperscale also raised $5.1 million by selling roughly 65 BTC during the week through Aug. 30. It said the proceeds would help fund work at the Michigan site.

BitcoinTreasuries.NET lists the company with 215 BTC valued at about $16.7 million. Compared with the July figure, that represents a decline of about 79%. The platform ranks Hyperscale 84th among the public companies it tracks. 

Hyperscale Shares Fall to Split-Adjusted Record

The operational shift comes as Hyperscale’s shares trade near record lows.

The company’s NYSE American-listed stock fell about 17% on Wednesday, closing at $0.1984 after reaching $0.1934 intraday, according to Yahoo Finance data. The closing level marked a split-adjusted record low.

The move came shortly after Hyperscale completed a reverse stock split at a ratio of one share for every five shares outstanding. Trading on the adjusted share basis began Aug. 25, according to a filing with the U.S. Securities and Exchange Commission (SEC).