Coldcard Hacker Swaps Stolen Crypto to ETH via THORChain

• The Coldcard Wave 3 hacker moved stolen funds on-chain for the first time.
• The funds were swapped into Ethereum via THORChain.
• The activity was identified by Galaxy’s Head of Research, Alex Thorn.

The Coldcard Wave 3 hacker has moved stolen cryptocurrency on-chain for the first time since the incident, according to Galaxy Head of Research Alex Thorn.

The transaction involved swapping the stolen assets into Ethereum (ETH) through THORChain, a cross-chain decentralized liquidity protocol. The movement marks the first known on-chain activity involving the stolen funds, drawing attention from blockchain analysts and investigators monitoring the wallets.

Such transactions are often closely tracked as they may provide clues about how stolen assets are being managed or laundered.

THORChain Used for Cross-Chain Swap

According to Thorn, the attacker used THORChain to convert the stolen funds into Ethereum.

Cross-chain protocols enable users to exchange assets across different blockchains without relying on centralized exchanges. While these protocols serve legitimate purposes, they can also be used by attackers attempting to move or obscure stolen funds across multiple networks.

Blockchain analytics firms and security researchers will likely continue monitoring the associated wallet addresses for further activity.

Investigators Continue Monitoring

The latest Coldcard hacker funds movement highlights the importance of blockchain transparency in tracking illicit transactions.

Although the attacker has begun moving assets, every on-chain transaction creates a public record that investigators can analyze. Security firms, exchanges, and compliance teams are expected to continue monitoring the wallets for additional transfers and potential attempts to cash out the stolen cryptocurrency.