Coldcard Hacker Begins Swapping Stolen Bitcoin for Ether

Stolen Bitcoin begins moving through THORChain

A hacker linked to a series of thefts from Coldcard wallets has started swapping stolen Bitcoin for Ether. Coldcard is a hardware wallet, which is a physical device used to store cryptocurrency keys offline to keep them safe from online threats.

Researchers observed the hacker using THORChain to move the funds. THORChain is a decentralized network that allows users to swap one type of cryptocurrency for another across different blockchains without using a central exchange.

According to reports from Galaxy Research, this is the first time funds from any of the three waves of the Coldcard exploit have moved from their original hacker-controlled addresses.

Important numbers and transaction details

• The hacker has moved approximately 10% of the stolen Bitcoin.
• About 90% of the stolen funds remain untouched in the original addresses.
• The exploit involved the theft of at least 1,789 Bitcoin from 8,865 different addresses.
• The stolen assets were worth roughly $114.7 million at the time they were taken.

Galaxy research identifies new hacker address

Alex Thorn, the head of research at Galaxy, reported that the hacker is facing some technical difficulties. The attacker has repeatedly tried to swap funds through THORChain but keeps receiving refunds and retrying the process.

Onchain analysts—people who track public transaction data on the blockchain—have traced the assets to a new Ethereum address. Thorn stated that this information has been shared with crypto companies and the relevant authorities to help monitor the movement of the stolen wealth.

Confirmed facts about the fund movement

It is confirmed that the hacker is currently active. On August 28, the attacker swept a wallet that a researcher had deliberately weakened to test if the hackers were still looking for vulnerable keys. Additionally, blockchain security firm CertiK reported in August that hackers linked to this exploit sent 64 Bitcoin and 200 Ether to Tornado Cash, which is a tool used to hide the history of crypto transactions.

Unclear details regarding the hacker's intent

While the movement of 10% of the funds is confirmed, it is still unclear if the hacker will try to move the remaining 90% soon. It is also unknown whether the attacker will attempt to move the assets to a centralized exchange or use other methods to further hide the location of the funds.

Why this movement matters for security

Tracking these funds is important for the crypto industry to help prevent the hacker from successfully cashing out. By identifying the new Ethereum address, security teams and exchanges can better monitor and potentially block the stolen assets if they reach a platform that requires identity verification.

Sources

• Cointelegraph