The attacker behind the third wave of Coldcard hardware wallet hacks has moved to the active phase of liquidating illegally obtained assets. According to my analysis of on-chain data, the hacker has begun exchanging stolen bitcoins for Ethereum through the decentralized protocol THORChain. This is a landmark event, as this is typically how attempts are made to "launder" traces of digital assets before their further transfer or sale on the open market.
At this point, approximately 10% of the total volume of stolen funds has been moved during this operation. The remaining 90% of the bitcoins are still located at the original addresses, indicating that the hacker is acting cautiously and in stages, likely testing the network's resilience to transaction tracking. This approach is typical of professional cybercriminals who seek to minimize the risks of asset freezes on centralized exchanges.
Let me remind you that within the framework of this attack, which I am tracking in detail, at least 1789 BTC, distributed across 8865 addresses, have been compromised. This is one of the largest thefts in the history of hardware cryptocurrency wallets, affecting a significant number of users. It is important to emphasize that this transfer is the first from the hacker's original addresses within the third wave, making it a key indicator for further monitoring.
From a technical standpoint, the choice of THORChain for exchanging BTC for ETH is not accidental. This protocol provides cross-chain swaps without the need to undergo KYC, which creates additional difficulties for law enforcement agencies and analytical companies when trying to identify the ultimate recipient of the funds. Although the 10% volume may seem insignificant, it demonstrates the hacker's intention to gradually withdraw assets, which requires increased vigilance from the community.
My comment: In the current situation, Coldcard owners who may have been affected by the attack should immediately conduct an audit of their wallets. The hacker typically acts quickly when it comes to liquidating assets, and every day of delay increases the risks for victims. The market should also take into account that potential pressure on ETH from these swaps could create short-term volatility.