Coldcard Hacker Starts Swapping Stolen Bitcoin to Ether

A hacker behind the Coldcard wallet thefts began converting stolen Bitcoin to Ether through THORChain on September 3, Galaxy Research says.

The hacker behind the third wave of Coldcard wallet thefts began converting stolen Bitcoin into Ether on September 3, using the cross-chain protocol THORChain, according to Alex Thorn of Galaxy Research. Thorn said the attacker had moved roughly 10 percent of the stolen Bitcoin at the time of his update, with the remaining 90 percent still sitting at the same address.

Researchers traced the transactions to a new Ethereum address surfaced through THORChain. Thorn said he had passed that address to law enforcement, cryptocurrency companies, and other groups tracking the stolen funds. He described the activity as the first recorded on-chain movement from the original wallets tied to the first three attack waves.

THORChain lets users swap native assets across blockchains without depositing funds into a centralised exchange. In this case, it allowed the hacker to turn native Bitcoin into Ether without routing the coins through a custodial platform. That structure makes the swaps harder to freeze than a transfer through a company-run exchange.

Not all of the attempts worked. Thorn said the hacker appeared to run into technical trouble while trying to complete some of the swaps. He pointed to possible causes such as a fault in the system or a shortage of liquidity on the protocol, without pinning down a single reason.

Where the Ether goes next remains an open question. Thorn said it would be worth watching whether the funds are pushed toward centralised exchanges, cross-chain bridges, or privacy protocols. He also noted that these THORChain swaps are separate from an earlier laundering operation carried out by different hackers. CertiK reported in August that wallets tied to that wider scheme had moved 64 BTC and 200 ETH into crypto mixing services.

The 2021 firmware flaw

The thefts trace back to weak randomness generation in a Coldcard firmware version released in 2021. The defect let attackers calculate users' private keys without ever touching the physical devices. That remote element set the attacks apart from the more familiar model of a breach at a centralised exchange.

Coinkite, the company that makes Coldcard, says a firmware fix is now available for every affected model. Its current security guidance warns that seeds created under the flawed software still need to be migrated. Installing the update alone does not repair a seed generated under the vulnerable firmware.

To be safe, Coinkite advises affected users to generate a new seed on the updated firmware and then move their Bitcoin to the new wallet address. Simply upgrading the device without creating a fresh seed leaves the underlying weakness in place.

At least 15 hackers involved

The scale of the exploitation goes well beyond a single actor. In a separate report in August, Thorn said at least 15 different hackers had taken advantage of the Coldcard vulnerability. He credited reports from victims with helping his firm identify new attackers who would otherwise have stayed anonymous, because the exploit worked differently from a typical exchange breach.

The latest swaps mark a shift from holding to moving the stolen coins, and the disclosure of the new Ethereum address to authorities and monitoring firms is aimed at tracking the funds before they can be obscured. With the bulk of the Bitcoin still parked at the original address, further movements are likely to be watched closely.

*Cryptocurrency is an unregulated digital asset, is not legal tender, and is subject to market risks. Nothing in this article constitutes financial or investment advice.*

Coldcard hack, THORChain, Bitcoin to Ether swap, Coinkite firmware, crypto wallet theft, Alex Thorn Galaxy Research, crypto private keys, stolen Bitcoin