A hacker linked to the third wave of thefts from Coldcard hardware wallets has begun converting stolen Bitcoin into Ether through the THORChain protocol, according to analysis by Galaxy Research. The move, which saw approximately 10% of the stolen funds transferred onchain, follows reports that hackers had previously sent 64 Bitcoin and 200 Ether to cryptocurrency mixers, including Tornado Cash, in August.
The stolen funds, valued at $114.7 million at the time of the theft, remain largely untouched, with the majority still unaccounted for. Galaxy Research’s head of research, Alex Thorn, noted that the hacker has encountered repeated issues during attempts to swap the Bitcoin for Ether via THORChain, resulting in multiple refunds.
THORChain, a blockchain protocol facilitating cross-chain swaps, has been used to convert the stolen Bitcoin into Ether, though the process has proven inconsistent. CertiK, a blockchain security firm, had earlier flagged suspicious activity involving the movement of funds to mixers, highlighting concerns over the potential for further obfuscation of the stolen assets.
The hacker’s next steps remain unclear, with uncertainty over whether they will attempt to move the remaining funds through an exchange or further obscure their trail. The identity of the individual behind the theft, which affected 8,865 Coldcard wallet addresses, has not been disclosed.
Written by Daniel Brooks
Security Desk
