Coldcard hacker converts stolen Bitcoin to Ether through THORChain

An attacker linked to the third wave of Coldcard wallet thefts has begun swapping stolen Bitcoin for Ether using the decentralized protocol THORChain. Galaxy Research reports that the hacker moved roughly 10% of the stolen funds, marking the first onchain movement from the original addresses. The underlying exploit, caused by a 2021 firmware vulnerability that weakened seed entropy, compromised 1,789.28 Bitcoin worth $114.7 million. Coinkite has released patched firmware but warns users that they must migrate to entirely new wallet seeds to secure their assets.

THORChain Bitcoin-to-Ether swaps

• ▪The third-wave Coldcard attacker moved approximately 10% of their stolen Bitcoin through THORChain, while around 90% of the funds remained unmoved at the original addresses.
• ▪An attacker associated with the third wave of Coldcard wallet thefts began converting stolen Bitcoin into Ether through THORChain on September 2, 2026.
• ▪The third-wave Coldcard attacker experienced technical issues during the THORChain swaps, resulting in repeated transaction refunds and subsequent resubmission attempts.

Coldcard firmware vulnerability

• ▪An address linked to the Coldcard exploit swept Bitcoin from a deliberately weakened researcher test wallet on August 28, 2026, indicating that automated scanning for vulnerable keys remained active.
• ▪The Coldcard wallet thefts were caused by a weak seed generation vulnerability in firmware released from 2021, which reduced randomness and allowed attackers to derive private keys remotely.
• ▪Galaxy Research attributed the loss of 1,789.28 Bitcoin across 8,865 addresses, worth approximately $114.7 million at the time of theft, to the Coldcard firmware vulnerability.

Stolen Bitcoin movement tracking

• ▪Galaxy Research head Alex Thorn shared a newly identified Ethereum address, which received the swapped Coldcard funds, with law enforcement, crypto companies, and monitoring organizations.
• ▪The September 2, 2026 transactions represented the first detected onchain movement of funds from the original hacker addresses associated with the first three Coldcard attack waves.

Cross-chain laundering methods

• ▪THORChain enables cross-chain swaps of native assets like Bitcoin and Ether without requiring users to deposit funds into a centralized custodial exchange.
• ▪CertiK reported in August 2026 that wallets linked to the broader Coldcard exploit sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.

Wallet seed migration requirements

• ▪Coinkite stated that installing corrected firmware does not repair existing vulnerable wallet credentials, meaning affected users must generate a new seed and migrate their assets.
• ▪Coinkite released corrected firmware across affected Coldcard models to address the weak seed generation vulnerability.

2 sources