A hacker connected to the “third wave” of Coldcard wallet attacks swaps stolen Bitcoin for Ether using the THORChain cross-chain platform, according to transaction tracing by researchers.
Galaxy Research’s Alex Thorn tracks the movement of funds and links the activity to a new Ethereum address. One report says the attacker routes about 10% of the stolen Bitcoin through THORChain before and after the conversion, with the resulting Ethereum assets landing on the identified address.
The outlets also note that some of the attempted swaps do not complete. NDTV reports that failed swaps may stem from technical issues or limited liquidity on the swapping route, while Cointelegraph frames the activity as part of broader movement of the stolen holdings. Both emphasize that monitoring organizations are being informed of the address associated with the conversion so funds can be tracked further.
