Galaxy research head Alex Thorn said the exploiter linked to the third wave of Coldcard thefts has started moving stolen Bitcoin for the first time, swapping part of the funds into Ether through THORChain. Thorn estimated that roughly 10% has moved while about 90% remains untouched, making the transfers the first observed on-chain movement from the original hacker addresses across any of the three waves.
COLDCARD WAVE 3 HACKER SWAPS FUNDS TO ETH VIA THORCHAIN
the wave 3 exploiter has moved stolen funds for the first time, swapping to ETH them through the THORChain cross-chain DEX
these are the first funds from wave 1, 2, or 3 to move onchain from the original hacker addresses pic.twitter.com/jjOrX5wBR9
— Alex Thorn (@intangiblecoins) September 2, 2026
The attacker has reportedly encountered friction while using THORChain, with some swap attempts being refunded and retried. Even so, researchers were able to trace the routed funds to a new Ethereum address, showing that the cross-chain swaps have not eliminated visibility into the movement of the stolen assets.
Thorn said the identified Ethereum address has been shared with relevant authorities and crypto companies. The next question is whether the exploiter can move or obscure the converted assets further, leaving continued tracing of the Ethereum destination as the immediate focus while most of the third-wave funds remain stationary.
Source: Alex Thorn (@intangiblecoins) on X.
Disclaimer: Crypto Economy Flash News are based on verified public and official sources. Their purpose is to provide fast, factual updates about relevant events in the crypto and blockchain ecosystem.
This information does not constitute financial advice or investment recommendation. Readers are encouraged to verify all details through official project channels before making any related decisions.
