Coldcard hacker swaps stolen Bitcoin for ETH via THORChain
A hacker linked to the third wave of Coldcard wallet thefts has begun swapping stolen Bitcoin for Ether using the THORChain protocol, moving about 10% of the illicit funds.
Intelligence analysis by Gemini 2.5 Flash
On-chain analysts, including Galaxy's head of research Alex Thorn, have traced approximately 10% of Bitcoin stolen in a Coldcard wallet exploit to a new Ethereum address after the hacker used THORChain for cross-chain swaps. This marks the first on-chain movement from the original hacker addresses, with the attacker reportedly facing some difficulties in completing all desired swaps.
Imagine someone stole a bunch of special digital coins from many piggy banks. Now, they're trying to secretly swap some of those stolen coins for a different kind of digital coin, using a special digital exchange that lets them switch between different types of coins. Even though they're trying to be sneaky, smart detectives are watching every move on the digital ledger, like following footprints in the snow, and have already figured out where some of the swapped coins ended up.
Analysis
Coldcard
The Coldcard wallet exploit, which led to the theft of at least 1,789 Bitcoin from 8,865 addresses, represents a significant security breach within the cryptocurrency ecosystem. Valued at approximately $114.7 million at the time of the thefts, this incident underscores the persistent vulnerabilities that can affect even hardware wallets, which are generally considered among the most secure methods for storing digital assets.
The third wave of this exploit has now seen its first on-chain movement of funds, indicating a new phase in the hacker's attempts to obscure the origins of the stolen assets. Previously, some funds from earlier waves were sent to mixers like Tornado Cash, but this latest activity involves direct cross-chain swaps, adding another layer of complexity to tracing and potential recovery efforts.
THORChain
THORChain, a decentralized cross-chain liquidity protocol, was utilized by the Coldcard hacker to swap stolen Bitcoin for Ether. This choice of platform allows for direct asset exchanges between different blockchains without relying on centralized intermediaries, which can make tracing more challenging for authorities and security firms.
However, the article notes that the hacker encountered issues, with some transactions being refunded, suggesting that even sophisticated tools like THORChain are not foolproof for illicit activities. The transparency of blockchain technology still allows on-chain analysts to follow the flow of funds, even when cross-chain swaps are involved, as demonstrated by the successful tracing to a new Ethereum address.
Alex Thorn
Alex Thorn, the head of research at Galaxy, played a crucial role in publicly reporting and tracing the movement of these stolen funds. His detailed updates on X (formerly Twitter) provided real-time insights into the hacker's activities, including the percentage of funds moved and the new destination address on the Ethereum network.
Thorn's work exemplifies the growing importance of on-chain analytics in combating crypto crime. By sharing the traced Ethereum address with relevant authorities and crypto companies, he facilitates a collaborative effort to potentially freeze or recover the assets, or at least to monitor their further movement. This proactive approach by researchers is vital in the ongoing fight against illicit financial activities in the decentralized space.
Key points
- A hacker from the third wave of Coldcard wallet exploits moved about 10% of stolen Bitcoin.
- The stolen Bitcoin was swapped for Ether using the THORChain decentralized protocol.
- Galaxy head of research Alex Thorn traced the funds to a new Ethereum address.
- The hacker reportedly faced difficulties completing all desired swaps on THORChain.
- Previously, some Coldcard exploit funds were sent to cryptocurrency mixers like Tornado Cash.
The successful tracing of the stolen funds to a new Ethereum address, despite the hacker's use of a cross-chain protocol, demonstrates the increasing effectiveness of on-chain analytics and the potential for collaboration between researchers and authorities to combat crypto crime. This could lead to improved security measures and better chances of asset recovery in future incidents.
The continued movement of stolen funds, even with tracing efforts, highlights the persistent challenge of recovering assets once they leave the original wallets. The hacker's attempts to obscure the funds through swaps and potential further movements to exchanges or mixers suggest a difficult path for victims to reclaim their lost Bitcoin.
