Coldcard Hacker Moves Stolen BTC to Ether via THORChain

Image
var isDesktop = window.innerWidth > 1050;
var cardOrTerminal = isDesktop
? `TerminalEvery BTC signal – one screen›`
: `ExchangesView top BTC exchanges (USA)›`;

var toppickThirdHeader = `

Top Tools & Picks

Bitbo ProUnlock 70+ private charts›WalletsView top BTC hardware wallets›
${cardOrTerminal}

`;

var postContent = document.querySelector(‘.post__content’);
if (postContent) {
var h2s = postContent.querySelectorAll(‘h2’);
if (h2s.length > 0) {
// Insert the main Top Picks above first h2
h2s[0].insertAdjacentHTML(‘beforebegin’, toppicksHTML);
}
if (h2s.length > 2) {
// Insert the Credit Card Top Pick above third h2
h2s[2].insertAdjacentHTML(‘beforebegin’, toppickThirdHeader);
}
}

// Event tracking for both Top Picks sections
setTimeout(function() {
var picks = document.querySelectorAll(‘.top-picks .pick-row’);
picks.forEach(function(pick) {
pick.addEventListener(‘click’, function() {
var pickName = pick.getAttribute(‘data-pick’);
if (typeof window.plausible === ‘function’) {
window.plausible(‘Click Top Pick’, { property: pickName || ‘Top Pick’ });
}
});
});
}, 0);
});

A hacker tied to the Coldcard wallet exploits has begun converting stolen <a href="https://xpertsstudio.com/trump-may-end-iran-war-what-it-means-for-oil-bitcoin-and-markets-market-donald-trump/” title=”Trump May End Iran War: What It Means for Oil, Bitcoin and Markets | Market Donald Trump”>bitcoin into ether through THORChain, marking the first time funds from the three-wave attack have moved from their original addresses.

First onchain movement detected

Galaxy Research head Alex Thorn reported on September 3 that the third-wave exploiter moved roughly 10% of the stolen funds, with 90% still sitting untouched.

Thorn noted it was the first time any of the three waves’ funds had moved onchain from the hacker’s original addresses.

He described the process as messy, saying the swaps kept getting refunded:

“The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying.”

Funds traced to Ethereum

Onchain analysts followed the trail through THORChain to a new Ethereum address.

Thorn said he had shared the address with relevant authorities and crypto companies, though it remains unclear whether the attacker will try to further obscure the assets or move them through an exchange.

Scale of the Coldcard exploit

Galaxy Research previously linked the Coldcard vulnerability to the theft of at least 1,789 bitcoin from 8,865 addresses, worth roughly $114.7 million at the time they were drained.

Blockchain security firm CertiK reported in August that hackers connected to the exploit had already sent 64 BTC and 200 ETH to cryptocurrency mixers including Tornado Cash.

Attackers still active

The latest movement came just days after Thorn said the Coldcard attackers were still operating.

He pointed to the August 28 sweep of a deliberately weakened researcher wallet that had been set up to test whether the attackers could find vulnerable keys — and they did.

Source: bitbo.io