Coldcard hacker moves stolen Bitcoin to Ether

A Coldcard hacker moved 10% of stolen Bitcoin to Ether via THORChain. Most funds remain untouched. Authorities and crypto firms have been alerted to the new Ethereum address.

A hacker linked to the third wave of Coldcard hardware wallet thefts has moved stolen Bitcoin for the first time since the attacks. About 10% of the illicit funds—roughly 20.5 BTC, valued at around $1.1 million—were converted into Ether via the cross-chain decentralized exchange THORChain. This marks the first onchain movement from the original hacker addresses associated with any of the three documented Coldcard theft waves. The majority of the stolen Bitcoin, approximately 90%, remains in the original wallets. The hacker faced technical difficulties during the conversion, with several swap attempts through THORChain being refunded before one succeeded. Onchain analysts have traced the transferred funds to a new Ethereum address, which has been shared with law enforcement and major crypto firms. The exploit stemmed from a seed-generation flaw in Coldcard firmware from March 2021 to 2023, allowing attackers to reconstruct private keys and steal at least 1,789 Bitcoin from over 8,800 addresses. Losses are estimated at $114.7 million. Authorities and crypto companies have been notified of the new Ethereum address, but it is unclear if further laundering steps will follow.