Coldcard Hacker Moves Stolen Bitcoin Into ETH via THORChain
A Coldcard hacker linked to the wallet thefts has moved about 10% of the stolen Bitcoin through THORChain and swapped part of it for Ether, according to Galaxy Research head Alex Thorn. Blockchain analysts traced the assets to a new Ethereum address and shared the information with authorities and crypto companies.
The Coldcard hacker reportedly encountered repeated refunds while attempting to complete the swaps. About 90% of the stolen funds remain untouched. Thorn said this was the first on-chain movement from the original addresses linked to any of the three Coldcard theft waves.
Galaxy Research previously linked the attacks to the theft of at least 1,789 BTC from 8,865 addresses. The Bitcoin was worth approximately $114.7 million when stolen. In August, CertiK said wallets associated with the exploit had transferred 64 BTC and 200 ETH to mixers including Tornado Cash.
The latest activity could indicate further laundering attempts through decentralized exchanges, mixers or centralized exchanges. Traders should monitor the identified Ethereum address and THORChain flows, although the currently moved amount is unlikely to create significant broad-market selling pressure.
Neutral
The expected market impact is neutral because only about 10% of the stolen funds has moved, and the reported activity does not represent a broad change in Bitcoin or Ether supply. The transferred amount may create short-term volatility in BTC and ETH if the hacker sells through centralized exchanges, but the swaps were routed through THORChain and appear to be part of an asset-obfuscation effort rather than an open-market liquidation.
Historically, movements from wallets linked to major exploits, such as Mt. Gox, PlusToken and large exchange hacks, have triggered temporary selling fears and heightened blockchain-monitoring activity. Markets typically react more strongly when large amounts reach identifiable exchange deposit addresses. In this case, the funds were traced to a new Ethereum address, while most of the stolen balance remains dormant.
Short term, traders should watch for exchange inflows, mixer activity, further THORChain transactions and attempts to convert ETH into stablecoins. Confirmed deposits to major exchanges could produce localized bearish pressure. Long term, the incident may reinforce scrutiny of hardware-wallet security, cross-chain bridges and decentralized liquidity protocols, but it is unlikely to materially affect Bitcoin or Ethereum market stability unless the remaining balance begins moving rapidly.