Coldcard Hacker Initiates Bitcoin-to-Ether Swaps via THORChain Amidst Ongoing Exploits

A significant development has emerged in the ongoing saga of Coldcard wallet thefts, as a hacker identified as being linked to the "third wave" of these exploits has begun converting stolen Bitcoin (BTC) into Ether (ETH) using the THORChain cross-chain decentralized exchange (DEX). This marks the first instance of funds originating from the hacker’s addresses in any of the three identified waves of theft being moved on-chain. The activity was first brought to light by Alex Thorn, head of research at Galaxy, who detailed the movements on the social media platform X (formerly Twitter) on Wednesday.

According to Thorn’s analysis, approximately 10% of the total stolen funds have been moved by the exploiter, leaving a substantial 90% of the cryptocurrency still untouched in the original hacker addresses. Thorn noted that the hacker appeared to be encountering difficulties in completing the entire swap process through THORChain, experiencing repeated refunds while persistently attempting the transactions. This suggests a potential challenge in the hacker’s execution of their laundering strategy.

Further on-chain analysis, as reported by Thorn, traced the movement of these funds through THORChain to a newly established Ethereum address. Thorn confirmed that this address has been shared with relevant authorities and cryptocurrency companies, indicating a coordinated effort to track and potentially recover the stolen assets. The ultimate intentions of the attacker regarding further obfuscation or the movement of these assets through centralized exchanges remain unclear at this time.

These recent transactions follow a series of Coldcard exploits that Galaxy Research has linked to the theft of a substantial amount of Bitcoin. Collectively, these exploits are estimated to have resulted in the loss of at least 1,789 Bitcoin from 8,865 distinct addresses, a sum valued at approximately $114.7 million at the time of the thefts. The initial exploitation events appear to have occurred over a period, with different "waves" of activity being identified by security researchers.

Prior to this recent development, in August, blockchain security firm CertiK had reported on earlier activities of hackers associated with the Coldcard exploit. At that time, these hackers were observed sending 64 Bitcoin and 200 Ether to cryptocurrency mixers, specifically naming Tornado Cash as one of the privacy-enhancing services utilized. The use of mixers is a common tactic employed by illicit actors to obscure the origin and destination of stolen funds, making them more difficult to trace.

The latest movement of funds also comes on the heels of Thorn’s recent assertion that the Coldcard attackers remained actively engaged in their operations. He cited an incident on August 28th where a deliberately weakened researcher wallet was swept by the attackers. This particular wallet was intentionally designed with vulnerabilities to test the attackers’ capabilities in identifying and exploiting compromised private keys. The successful sweep of this test wallet underscored the ongoing threat posed by these actors and their persistent efforts to locate and exploit vulnerable systems.

The Coldcard wallet is a popular hardware wallet known for its focus on security and self-custody of Bitcoin. Hardware wallets are designed to store private keys offline, making them significantly more secure than software wallets or exchange-based storage. However, vulnerabilities can still arise from various factors, including potential flaws in the device’s firmware, user error in key management, or sophisticated social engineering attacks that trick users into revealing their recovery phrases. The nature of the exploit that allowed for the widespread theft of Bitcoin from Coldcard users has been a subject of intense investigation within the cybersecurity and cryptocurrency communities.

The involvement of THORChain in this recent activity is noteworthy. THORChain is a cross-chain liquidity protocol that allows users to swap cryptocurrencies across different blockchains without the need for centralized intermediaries. By utilizing THORChain, the hacker is attempting to convert their Bitcoin holdings into Ether, a common strategy to diversify their stolen assets and potentially move them into a different ecosystem, making subsequent tracing more challenging. The fact that the hacker is encountering difficulties with the swaps suggests that THORChain’s network may have implemented safeguards or that the specific transaction patterns are being flagged.

The ongoing nature of these exploits and the subsequent attempts to launder the stolen funds highlight the persistent challenges faced by law enforcement and security firms in the cryptocurrency space. The decentralized and pseudonymous nature of blockchain technology, while offering benefits for privacy and censorship resistance, can also be exploited by malicious actors to facilitate financial crimes. The ability to trace transactions on public blockchains, however, remains a critical tool in combating such activities.

The collaboration between entities like Galaxy Research, CertiK, and relevant authorities is crucial in piecing together the complex web of transactions and identifying the perpetrators. The sharing of information, such as the newly identified Ethereum address, is a vital step in the investigative process. The cryptocurrency industry continues to grapple with the evolving landscape of cyber threats, with constant innovation in both attack vectors and defense mechanisms.

The total value of the stolen Bitcoin, $114.7 million, represents a significant financial loss for the victims and a considerable gain for the attackers. The efforts to recover these funds are ongoing, and the current activity through THORChain represents a new phase in the investigation. The cryptocurrency community remains vigilant, with researchers and analysts continuously monitoring the blockchain for any suspicious movements or new developments related to this extensive Coldcard exploit. The outcome of these efforts will have implications for the broader security of hardware wallets and the ongoing fight against cryptocurrency-related crime.