Coldcard Hacker Swaps Stolen Bitcoin Through THORChain
Galaxy Research said the attacker moved about 10% of the stolen Bitcoin, while roughly 90% remained at the original addresses.
- On September 3, a hacker associated with the third wave of Coldcard thefts began converting stolen Bitcoin into ETH through the THORChain decentralized exchange, marking the first onchain transfer from original hacker addresses.
- The theft originated from a firmware vulnerability released in 2021 that weakened seed generation in Coldcard devices, allowing attackers to derive private keys remotely without requiring victims to approve transactions or reveal credentials.
- Galaxy Research estimates the vulnerability affected 8,865 addresses, resulting in the loss of 1,789.28 BTC, though these recent THORChain swaps remain distinct from earlier laundering activities involving cryptocurrency mixers.
- Investigators are monitoring the new Ethereum address after Thorn shared it with law enforcement and crypto companies; centralized exchanges remain key intervention points because they conduct identity and sanctions checks.
- To secure remaining funds, Coinkite, Coldcard's manufacturer, advises users to install corrected firmware and generate a new seed, as updating software cannot repair already compromised credentials.
46 Articles
46 Articles
Hacker Steals USD 340 Million in Bitcoin Heist and Returns Most Funds; Know What Happened | 📲 LatestLY
A hacker stole around USD 340 million in bitcoin from Blockstream’s Liquid Network in one of the year’s largest crypto thefts. The network was temporarily paused after the exploit, with the attacker later returning about 3,400 of nearly 4,000 stolen bitcoins. Around 600 bitcoins, worth roughly USD 47 million, remained with the exploiter. 📲 Hacker Steals USD 340 Million in Bitcoin Heist and Returns Most Funds; Know What Happened.
In this article, we review the details of the incident and its impact on the network. The return of 3,400 Bitcoin stolen by the Liquid pirates on Sunday, 6 September 2026, nearly 4,000 Bitcoin was withdrawn from the Liquid network, but... the article appeared to be the return of 3,400 Bitcoin from the Liquid pirates: Details of the incident first on Battery Robotics.
TechCrunch
A hacker stole $340M in a crypto heist, then returned most of it
The latest heist is one of the largest thefts of cryptocurrency to date.
Coldcard Theft Funds Begin Moving as Hacker Routes Bitcoin Through THORChain
Stolen Bitcoin from the third wave of the Coldcard wallet attacks has begun leaving the hacker’s original addresses, with part of the holdings being swapped into Ethereum through THORChain. The movement is the first recorded departure of funds from the original attacker addresses across any of the three waves, according to Alex Thorn, Galaxy’s head of research.Visit Website
Coverage Details
Bias Distribution
- 75% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
