Home
Cryptocurrency
Cryptocurrency News
Coldcard Hacker Converts Stolen Bitcoin to ETH Through THORChain

Coldcard Hacker Converts Stolen Bitcoin to ETH Through THORChain

The hacker moved about 10 percent of the stolen Bitcoin, while roughly 90 percent remained at the original address.

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 3 September 2026 19:20 IST

Coldcard Hacker Converts Stolen Bitcoin to ETH Through THORChain

Photo Credit: Unsplash/Shutter Speed

THORChain enables native Bitcoin and Ether swaps without relying on a centralised exchange

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Alex Thorn shared the new Ethereum address with law enforcement
THORChain swaps do not require a traditional custodial exchange
At least 15 hackers have reportedly exploited the Coldcard flaw

The hacker behind the third wave of Coldcard wallet hacks started swapping the stolen Bitcoins to Ether via THORChain from September 3, stated Alex Thorn of Galaxy Research. The hacker transferred about 10 percent of his stolen Bitcoins, said Thorn. 90 percent was still at the same address when the update came out. The researchers were able to track the transactions to a new Ethereum address discovered on THORChain. Thorn added that he had disclosed the new Ethereum address to law enforcement, cryptocurrency companies, and other organisations monitoring the stolen assets.

Coldcard Vulnerability Allowed Private Keys to Be Calculated Remotely

THORChain permits users to swap native assets across blockchains without depositing their funds into any central exchange. In that regard, THORChain is able to turn native Bitcoin into Ether without depending on any traditional custodial exchange. Nevertheless, not every transaction turned out successfully. According to Thorn, the hacker seemed to be having some issues in terms of technology while trying to swap the transactions. This could be due to many reasons. There could be a problem in the system, or there might not be enough liquidity.

Crypto Hacks Discussion

Explore More...

This was the first movement recorded from onchain transactions for the original wallets linked to the first three attack waves, according to Thorn. It will be interesting to see if the ETH ends up moving to centralised exchanges, bridges, or privacy protocols. These recent THORChain swaps are not associated with the previous laundering scheme conducted by different hackers. CertiK reported in August that wallets involved in this wider scheme have laundered 64 BTC and 200 ETH into crypto mixing services.

Australia Sets September 30 Deadline for Crypto Firm Licensing

The theft was associated with poor randomness generation in Coldcard firmware version released in 2021. The flaw made it possible for the attackers to calculate the private keys without having to gain physical access to the devices. Coinkite, the maker of Coldcard, indicates that a firmware fix is available for all impacted models. Its security advice currently states that previously generated, impacted seeds will need migration. However, upgrading to the firmware will not fix a seed made under the impacted software. The user needs to make a new seed using the upgraded firmware and move Bitcoin to the wallet's address.

As per another report by Thorn in August, at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Crypto hacks, Crypto Frauds, BTC, ETH, Colcard wallet

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More