Hacker Begins Laundering Bitcoin Stolen From Coldcard Wallets via THORChain
·
03.09.2026 18:38
·
2 min read
The attacker behind the Coldcard hardware wallet exploit has begun moving the stolen cryptocurrency for the first time. As reported by The Crypto Times, the hacker routed 20.5 BTC through the THORChain decentralized cross-chain protocol, converting the funds into Ethereum and transferring them to a new address.
According to Alex Thorn, Head of Firmwide Research at Galaxy, this is the first recorded movement of funds from the primary wallets of the attack’s third wave. Meanwhile, roughly 90% of the Bitcoin stolen during this stage remains dormant.
The withdrawal process has run into technical glitches: several cross-chain transactions on THORChain resulted in refunded funds, forcing the hacker to resubmit the requests. Using a decentralized protocol allows swapping native Bitcoin for Ether without undergoing KYC checks on centralized exchanges, but all transaction chains remain public and traceable by on-chain analysts.
Losses Exceed 1,700 BTC
According to a report by Galaxy Research, total confirmed losses from the Coldcard exploit reached at least 1,789 BTC (around $114.7 million) across 8,865 compromised addresses. Analysts note that multiple independent hacker groups exploited the vulnerability.
The widespread breach was caused by a critical flaw in the random number generator algorithm within Coldcard’s firmware, introduced back in 2021. Due to insufficient entropy, attackers were able to mathematically derive users’ private keys through brute force without physical access to the hardware devices.
Security experts cited by ForkLog warn that a simple firmware update will not secure funds if the seed phrase was generated on a vulnerable version. Owners of affected wallets must generate a new seed phrase on an updated device and immediately transfer all assets to the new wallet.
