Coldcard Attacker Starts Moving Stolen Bitcoin Through THORChain Into Ether

By Isaac • September 3, 2026 11:16 am •

The attacker tied to the third wave of Coldcard wallet thefts has started moving Bitcoin from the original theft addresses, and the route is getting attention for a reason: part of the haul is being swapped into Ether through THORChain.

The transfer marks the first observed movement out of the original attacker addresses across the three documented waves, according to on-chain researcher Alex Thorn.

Cointelegraph says the Wave 3 attacker moved roughly 10% of that wave’s funds while about 90% remained untouched, with researchers following the activity through THORChain to a newly identified Ethereum address; Galaxy Digital research chief Alex Thorn described the transaction as the first time funds from any of the three waves had