Coldcard Hacker Converts Stolen Bitcoin to ETH Through THORChain

The hacker behind the third wave of Coldcard wallet hacks started swapping the stolen Bitcoins to Ether via THORChain from September 3, stated Alex Thorn of Galaxy Research. The hacker transferred about 10 percent of his stolen Bitcoins, said Thorn. 90 percent was still at the same address when the update came out. The researchers were able to track the transactions to a new Ethereum address discovered on THORChain. Thorn added that he had disclosed the new Ethereum address to law enforcement, cryptocurrency companies, and other organisations monitoring the stolen assets. 

Coldcard Vulnerability Allowed Private Keys to Be Calculated Remotely

THORChain permits users to swap native assets across blockchains without depositing their funds into any central exchange. In that regard, THORChain is able to turn native Bitcoin into Ether without depending on any traditional custodial exchange. Nevertheless, not every transaction turned out successfully. According to Thorn, the hacker seemed to be having some issues in terms of technology while trying to swap the transactions. This could be due to many reasons. There could be a problem in the system, or there might not be enough liquidity.

This was the first movement recorded from onchain transactions for the original wallets linked to the first three attack waves, according to Thorn. It will be interesting to see if the ETH ends up moving to centralised exchanges, bridges, or privacy protocols. These recent THORChain swaps are not associated with the previous laundering scheme conducted by different hackers. CertiK reported in August that wallets involved in this wider scheme have laundered 64 BTC and 200 ETH into crypto mixing services.

The theft was associated with poor randomness generation in Coldcard firmware version released in 2021. The flaw made it possible for the attackers to calculate the private keys without having to gain physical access to the devices. Coinkite, the maker of Coldcard, indicates that a firmware fix is available for all impacted models. Its security advice currently states that previously generated, impacted seeds will need migration. However, upgrading to the firmware will not fix a seed made under the impacted software. The user needs to make a new seed using the upgraded firmware and move Bitcoin to the wallet's address.

As per another report by Thorn in August, at least 15 different hackers have used this Coldcard vulnerability. Thorn explained that the victims' reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange.