Coldcard Hacker Uses THORChain to Convert Stolen Bitcoin to Ether

How THORChain Enabled the Conversion

A hacker linked to the third wave of Coldcard wallet thefts began moving stolen Bitcoin through THORChain on September 3, 2026, converting roughly 10% of the loot into Ether. The activity was identified by Alex Thorn of Galaxy Research, who traced the transactions as part of ongoing monitoring of the breach. The stolen funds originated from compromised Coldcard hardware wallets, which were targeted in a series of attacks earlier in the year. The hacker used THORChain’s decentralized cross-chain swapping mechanism to obscure the trail of the illicit Bitcoin.

THORChain allows users to swap assets across blockchains without relying on centralized exchanges, making it a tool both for legitimate users and those seeking to launder funds. In this case, the attacker routed Bitcoin through THORChain’s liquidity pools, receiving Ether in return. This method avoids traditional KYC checks and creates a complex transaction path that is harder to follow. Galaxy Research noted that the swap occurred in multiple small transactions to avoid triggering automated alerts. The use of THORChain highlights how decentralized finance protocols can be exploited despite their security-focused design.

What Measures Are Being Taken to Trace the Funds?

Blockchain analysts are monitoring the movement of the stolen Ether in real time, using chain analysis tools to follow the funds as they move between wallets and exchanges. While THORChain obscures direct links, the eventual conversion to fiat or use in identifiable services may expose the attacker. Researchers are also coordinating with exchanges to flag suspicious addresses tied to the swapped assets. The case underscores the challenges law enforcement faces when dealing with cross-chain activity in decentralized ecosystems. No arrests have been reported as of the latest update.

How much Bitcoin was moved through THORChain? Approximately 10% of the total stolen Bitcoin from the Coldcard attacks was swapped for Ether via THORChain, according to Galaxy Research’s tracking.

Frequently Asked Questions

Can THORChain prevent such misuse? THORChain operates as a permissionless protocol and does not have built-in mechanisms to block illicit transactions, though it relies on network validators and community governance to address abuse over time.

Is the stolen Ether still traceable? While the initial swap complicates tracking, analysts continue to follow the Ether’s movement, and future interactions with regulated platforms may reveal the attacker’s identity.