S&P 5007,666.60▲0.5% Nasdaq26,217.83▲0.5% Dow53,061.95▲0.6% Russell 2K2,953.17▲1.1% 10-Yr4.80%+0bp VIX15.20−1.14 WTI$90.70▲0.5% Gold$4,431.70▲1.9% EUR/USD1.159▼0.1% BTC$77,604▲0.4% Nikkei66,215▼0.1%
At close · Thu, Sep 3, 2026
Daily Market Updates.

Crypto

HomeCryptoMarket StructureColdcard-linked hacker routes about 10% of stolen Bitc…

Coldcard-linked hacker routes about 10% of stolen Bitcoin into ETH

Onchain analysts traced the THORChain flow to a new Ethereum address, while about 90% of the stolen funds reportedly remained untouched.

A hacker linked to the third wave of Coldcard wallet thefts has begun swapping stolen Bitcoin for Ether using THORChain, according to Cointelegraph. Galaxy Research head of research Alex Thorn said the exploiter moved about 10% of the stolen funds, with the remaining 90% reportedly left untouched.

Thorn said the movement was the first instance in which funds from any of the three Coldcard waves had moved onchain from the original hacker addresses. He added that the swap activity appears to be incomplete, with the hacker encountering issues as attempts to swap the full balance through THORChain were reportedly refunded and retried.

Thorn said onchain analysts traced the funds via THORChain to a new Ethereum address, which he shared with relevant authorities and crypto companies. Cointelegraph notes it remains unclear whether the attacker will try to further obscure or move the assets via a cryptocurrency exchange.

The transfers follow a Coldcard exploit that Galaxy Research linked to the theft of at least 1,789 Bitcoin from 8,865 addresses, worth about $114.7 million at the time. Cointelegraph also cited CertiK, which reported in August that hackers tied to the exploit sent 64 Bitcoin and 200 Ether to cryptocurrency mixers such as Tornado Cash.

Latest closeBitcoin $77,603.86 ▲0.4%|Ethereum $2,394.11 ▲0.1%

More like this

Sources

Get the close, explained.

One email every trading day: what moved, why it moved, and what's on deck tomorrow. Read in 3 minutes.

Free. Unsubscribe anytime.