Coldcard hacker uses THORChain to swap stolen BTC

A hacker associated with the third wave of Coldcard wallet thefts began converting stolen Bitcoin into Ether through THORChain on Sept. 3, according to Galaxy Research’s Alex Thorn. Summary Third-wave Coldcard attacker moved roughly 10% of stolen Bitcoin through THORChain into Ether this week. Researchers traced the swaps to a new Ethereum address and shared details with relevant authorities. Around 90% of the third-wave funds remained unmoved when Galaxy researcher Alex Thorn reported transfers. THORChain repeatedly refunded some swap attempts, prompting the attacker to resubmit transactions, Thorn reported Wednesday. Coinkite says affected seeds require migration because installing corrected firmware cannot repair existing wallet credentials. The transactions moved approximately 10% of the Bitcoin controlled by that attacker, Thorn said. Roughly 90% remained at its original addresses when he published the update. Researchers traced the swaps through THORChain to a newly identified Ethereum address. Thorn said he shared the address with law enforcement, crypto companies and other organizations monitoring the stolen assets. Coldcard hacker encounters failed THORChain swaps THORChai...