Coldcard Attacker Moves Stolen Bitcoin Through THORChain to Ethereum
The Coldcard hardware wallet attacker has begun moving stolen Bitcoin through THORChain to convert it into Ethereum, with on-chain analysis tracking approximately 20 BTC routed across multiple swaps in early September. Researchers identified Ethereum addresses as the final destination, marking the first significant movement of funds from the breach.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Stolen Funds on the Move
On-chain tracking firm Bitquery identified approximately 20.45 BTC moving through THORChain between September 2 and 3, with the attacker conducting 34 separate swaps to convert the stolen Bitcoin into Ethereum. The total value of the moved Bitcoin was approximately $1.6 million at the time of the transfers, according to CryptoSlate's analysis. This represents the first material movement of funds stolen in the Coldcard breach after a period of inactivity.
Routing Strategy Through Cross-Chain Bridge
The attacker chose THORChain, a cross-chain liquidity protocol, as the intermediary to swap Bitcoin for Ethereum rather than using traditional centralized exchanges. Researchers traced the final Ethereum destination addresses, which held roughly 5 ETH less than the initial conversion amount, suggesting either additional transfers or slippage during the swap process. The use of THORChain allows for atomic swaps without custodial risk and minimal KYC requirements, making it a common choice for moving stolen funds.
Scale of the Breach
According to Crypto.news, the moved Bitcoin represented roughly 10% of the total stolen amount from the Coldcard compromise, indicating substantially larger quantities of assets remain parked in the attacker's wallet. Security researchers have been monitoring the addresses for weeks, waiting for the first signs of asset movement that could provide clues to the attacker's identity or next steps.
Why It Matters
For Traders
Incoming Ethereum supply from converted stolen BTC may create localized selling pressure on ETH, though the 1.6M USD volume is modest relative to daily DEX throughput.
For Investors
The incident highlights that hardware wallet compromises remain a vector for large-scale theft and that cross-chain protocols enable rapid asset laundering without traditional exchange friction.
For Builders
THORChain's role in facilitating stolen asset movement underscores the need for cross-chain bridges to improve transaction monitoring and integrate with law enforcement reporting systems.
This article is for information only and is not financial advice. Read the full disclaimer.
