Coldcard Hacker Swaps Stolen Bitcoin Through THORChain
Researchers said the attacker moved about 10% of stolen Bitcoin through THORChain and may face technical issues as investigators track the new Ethereum address.
- On September 2, 2026, the COLDCARD WAVE 3 hacker moved stolen Bitcoin for the first time, swapping assets into Ethereum through the THORChain decentralized exchange.
- Weak seed generation in Coldcard firmware released since 2021 enabled attackers to derive private keys remotely without physical access to devices, unlike phishing attacks.
- Galaxy Research analyst Alex Thorn reported the hacker moved approximately 10% of the stolen Bitcoin while experiencing repeated technical difficulties attempting to process the swaps.
- Thorn shared the new Ethereum destination with law enforcement and crypto companies, enabling monitoring of subsequent deposits as centralized exchanges remain potential intervention points.
- Coinkite, the manufacturer of Coldcard, advises users to generate new seeds with corrected firmware, as researchers continue tracking funds linked to the separate Liquid Network theft.
47 Articles
47 Articles
Hacker Steals USD 340 Million in Bitcoin Heist and Returns Most Funds; Know What Happened | 📲 LatestLY
A hacker stole around USD 340 million in bitcoin from Blockstream’s Liquid Network in one of the year’s largest crypto thefts. The network was temporarily paused after the exploit, with the attacker later returning about 3,400 of nearly 4,000 stolen bitcoins. Around 600 bitcoins, worth roughly USD 47 million, remained with the exploiter. 📲 Hacker Steals USD 340 Million in Bitcoin Heist and Returns Most Funds; Know What Happened.
In this article, we review the details of the incident and its impact on the network. The return of 3,400 Bitcoin stolen by the Liquid pirates on Sunday, 6 September 2026, nearly 4,000 Bitcoin was withdrawn from the Liquid network, but... the article appeared to be the return of 3,400 Bitcoin from the Liquid pirates: Details of the incident first on Battery Robotics.
TechCrunch
A hacker stole $340M in a crypto heist, then returned most of it
The latest heist is one of the largest thefts of cryptocurrency to date.
Coldcard Theft Funds Begin Moving as Hacker Routes Bitcoin Through THORChain
Stolen Bitcoin from the third wave of the Coldcard wallet attacks has begun leaving the hacker’s original addresses, with part of the holdings being swapped into Ethereum through THORChain. The movement is the first recorded departure of funds from the original attacker addresses across any of the three waves, according to Alex Thorn, Galaxy’s head of research.Visit Website
Coverage Details
Bias Distribution
- 75% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
