Coldcard Hacker Swaps Stolen Bitcoin for Ether via THORChain

The case involves Bitcoin stolen in connection with Coldcard wallets. By using THORChain, a decentralized cross-chain liquidity protocol, the attacker can exchange assets across blockchains without relying on a centralized exchange, where compliance checks or account freezes could hinder the movement of funds. The route complicates recovery efforts and has drawn scrutiny from blockchain investigators tracking the proceeds.

On-chain analysis shows the hacker recently began moving the stolen funds, swapping about 10% of the Bitcoin for Ether through THORChain and sending the proceeds to newly identified Ethereum addresses. The report did not disclose the total amount stolen, the dollar value exchanged or a precise transaction date. Investigators have shared the relevant addresses and fund-flow intelligence with law-enforcement authorities and cryptocurrency organizations.