The attacker behind the Coldcard Wave 3 breach moved 20.5 bitcoin through Thorchain to Ethereum on September 2 or 3, marking the first transaction from the stolen funds in weeks, according to Galaxy Research.
The Coldcard Wave 3 hack, disclosed in July, compromised an estimated 2,000 hardware wallets manufactured by the company. Stolen private keys enabled the attacker to access customer funds across multiple blockchains. The hacker had remained inactive for an extended period before the latest cross-chain swap, which used Thorchain's decentralized liquidity pools to convert bitcoin to ether without requiring a centralized exchange account.
Thorchain enables users to swap cryptocurrencies across blockchains without custodians or KYC processes. The protocol's atomic swaps function through liquidity providers who facilitate the exchange. No approval or registration is required, making the service accessible to any address holder.
The 20.5 bitcoin movement represents the largest traced transaction from the Coldcard theft to date. Prior activity had been limited, with the attacker moving smaller amounts or holding positions across addresses. The conversion to Ethereum, a blockchain with greater on-chain privacy mixing options than Bitcoin's transparent ledger, occurred after weeks of apparent dormancy.
Coldcard, manufactured by Canadian firm Coinkite, is a standalone device designed to secure private keys offline. The July vulnerability affected units shipped during a specific production window. Coinkite disclosed the issue after researchers found that attackers could extract keys through physical access combined with software exploit chains. Customers were advised to move funds from affected devices immediately.
The attacker used Thorchain rather than traditional exchanges. On-chain mixers and privacy protocols on Ethereum, including Tornado Cash, have faced regulatory pressure in the United States and Europe, though the legal status of using such tools remains contested across jurisdictions.
The 20.5 bitcoin value at current market rates exceeds $850,000. The movement came after weeks in which forensic tracking firms had reported no new on-chain activity linked to the theft. The Thorchain swap resumed activity after the extended quiet period.
