Funds connected to the Coldcard wallet exploit have begun moving onchain, escalating the incident from a dormant compromise into an active laundering investigation.
Galaxy Research’s Alex Thorn reported that the attacker associated with the third wave of thefts moved approximately 10% of the stolen funds through THORChain, converting Bitcoin into Ether. Roughly 90% remained untouched when the activity was observed.
Researchers traced the cross-chain swaps into a new Ethereum address and shared the information with authorities and crypto companies.
The wider Coldcard incident has been linked to the theft of at least 1,789 BTC from 8,865 addresses, valued at approximately $114.7 million at the time.
The attacker reportedly encountered repeated THORChain refunds and retried transactions, giving investigators additional onchain activity to analyze.
TOKEN RECON ASSESSMENT
The intelligence picture has changed.
The stolen BTC is no longer simply sitting in compromised addresses. Cross-chain movement creates new laundering paths but also generates more observable transactions investigators can follow.
Watch: remaining original wallets, the newly identified Ethereum address, centralized exchange deposits and mixer interactions.
