Summary
- Coldcard Wave 3 hacker moved stolen Bitcoin from original addresses and converted part of it into Ethereum through THORChain for laundering purposes.
- Transaction details revealed replace-by-fee settings, recent locktimes, higher fees, and a two-of-two multisignature structure controlling the stolen funds across wallets.
- Investigators must trace activity across Bitcoin and Ethereum while most Wave 3 assets remain stored inside the original vaults untouched.
The Coldcard Wave 3 hacker has moved stolen Bitcoin directly from the original attacker-controlled addresses for the first recorded time. According to Galaxy Digital research head Alex Thorn, the exploiter converted part of the stolen BTC into Ethereum through THORChain.
This transaction ended the prolonged inactivity surrounding funds stolen during Wave 3 and revealed a possible laundering route. Moreover, researchers had not recorded direct spending from hacker addresses connected with Waves 1, 2, or 3.
The movement provides investigators with evidence showing how the attacker may transfer stolen assets beyond the original Bitcoin wallets. Instead of keeping everything inside the original vaults, the exploiter has started moving value between separate blockchain networks.
Consequently, investigators must connect transactions across Bitcoin and Ethereum while identifying destination wallets linked to the cross-chain swaps. THORChain enables users to exchange native cryptocurrencies across blockchains without relying on wrapped assets or centralized trading platforms. The protocol therefore provided a direct method for converting stolen Bitcoin into native ETH through decentralized liquidity pools.
Also Read: Bitcoin Stablecoin Demand Signal Weakens as BTC Holds Near $77,000
Transaction Details Reveal Changes in the Hacker’s Spending Methods
Thorn reported that the THORChain deposits included an OP_RETURN memo and the affiliate tag “sto” at zero basis points. These details may help researchers separate the hacker’s transactions from unrelated activity across the decentralized exchange protocol.
Significantly, Thorn identified technical differences between these transactions and wallets involved in the July and August sweeps. Later Bitcoin transactions enabled replace-by-fee, used recent locktimes, and carried higher network fees than the earlier transfers.
Additionally, the first Wave 3 spend exposed a two-of-two multisignature arrangement controlling the stolen Bitcoin. That structure requires two separate cryptographic signatures before the Bitcoin network can approve and process any transaction.
Later transfers used the same multisignature structure, although the exploiter relied on different keys for authorization. These variations suggest the attacker changed transaction software or adopted another process for managing the stolen assets.
However, available evidence does not establish who controls the wallets or which software produced every transaction. The ETH conversion complicates fund tracing because investigators must examine activity recorded across two independent public ledgers.
Researchers must match outgoing Bitcoin with THORChain swaps and monitor the corresponding Ethereum addresses for additional movement. Further transfers could reveal whether the attacker plans more swaps, divides the assets, or sends funds toward cryptocurrency exchanges. Nevertheless, most stolen Wave 3 Bitcoin remains inside the original vaults, leaving substantial balances under active investigation.
Also Read: Hyperliquid Unveils HIP-3* as Optional Layer for Permissioned Markets
The post Coldcard Hacker Moves Wave 3 Bitcoin Into Ethereum Through THORChain appeared first on 36Crypto.