The third-wave attacker reportedly moved about 10% of the stolen funds
Alex Thorn, head of research at Galaxy, said that the attacker linked to the third wave of Coldcard thefts moved about 10% of the stolen funds through THORChain, swapping Bitcoin for Ether. According to Thorn, 90% of the funds remain unused.
Thorn said this was the first on-chain movement from the original addresses attributed to the perpetrators of the three waves. He also said the attacker encountered difficulties swapping all the funds on THORChain, receiving refunds and repeating the attempts.
Funds traced to an Ethereum address
According to Thorn, on-chain analysts traced the funds through THORChain to a new Ethereum address. Thorn said he shared the address with relevant authorities and digital asset firms, and that it is unclear whether the attacker will attempt further transfers or use an exchange.
Galaxy Research had linked the exploit to the theft of at least 1,789 Bitcoin from 8,865 addresses. In August, CertiK reported that hackers linked to the exploit had sent 64 Bitcoin and 200 Ether to mixers, including Tornado Cash. Thorn also cited, on August 28, a transfer from a deliberately weakened research wallet created to test the attackers’ ability to identify vulnerable keys.
