Coldcard Hacker Uses THORChain to Swap Stolen BTC
An attacker behind a Coldcard-linked Bitcoin theft has reportedly used THORChain, a cross-chain liquidity protocol, to swap roughly 10% of the stolen BTC, a move that...
An attacker behind a Coldcard-linked Bitcoin theft has reportedly used THORChain, a cross-chain liquidity protocol, to swap roughly 10% of the stolen BTC, a move that complicates on-chain tracing and renews scrutiny of how self-custody funds get laundered once they leave a hardware wallet.
The reported route matters because THORChain lets users swap native assets across chains without a custodial intermediary, meaning stolen Bitcoin can be converted into other tokens without passing through a centralized exchange that might freeze the funds. That mechanic is precisely why the protocol keeps surfacing in fund-tracing cases involving self-custody breaches. For related coverage, see Bitcoin Hits $82,000 After Fed Dovish Signals as Ethereum, XRP, Dogecoin Jump.
KEY POINTS
- An attacker in a Coldcard-linked theft reportedly moved about 10% of the stolen Bitcoin through THORChain.
- THORChain’s cross-chain swaps let value exit into other assets without a custodial chokepoint, making funds harder to follow.
- The report remains partly unconfirmed, and only a fraction of the stolen BTC has been traced through the protocol so far.
The incident follows earlier reporting of Coldcard-related losses. AICryptoCore previously covered how Coldcard faced a suspected fourth attack wave involving about 388.9 BTC, part of a broader pattern of hardware-wallet users being targeted through supply-chain or seed-compromise vectors. For related coverage, see Bitcoin Miner Leaves Mine Site for AI Deal Worth Up to $1.2 Billion.
Why moving only part of the stolen BTC still matters
Even a partial transfer is significant for investigators. Swapping a portion first is a common laundering test: it lets an attacker gauge whether liquidity, slippage, and monitoring responses allow the rest to follow without triggering freezes or alerts. For related coverage, see Bitcoin Back Above $77,500 as XRP Leads Majors on Lower Fed Hike Odds.
Because THORChain settles into native assets on destination chains, portions of the proceeds can land as Ethereum-based tokens, where movements are visible on public explorers such as Ethereum blockchain records. That visibility is the double edge of cross-chain swaps: they obscure the direct BTC trail but leave a new, traceable footprint on the receiving chain.
What it means for wallet security and tracing
For self-custody users, the takeaway is operational, not theoretical. Once a seed or signing device is compromised, on-chain speed favors the attacker, and cross-chain routing shrinks the window for exchanges or law enforcement to intervene. The same AI-assisted monitoring now used to defend wallets is increasingly used to trace laundering flows across chains.
That convergence is visible elsewhere in the security stack. AICryptoCore has reported on how a Bitcoin red team used Kimi AI to hunt for potential flaws, an example of machine-driven analysis being applied to both offense and defense in Bitcoin infrastructure.
The details of this case remain partly unconfirmed, and the share of stolen funds routed through the protocol could shift as more of the trail is mapped. For decentralized-AI and on-chain analytics teams, incidents like this are becoming the primary benchmark for cross-chain forensic tooling, where the contest is increasingly model-versus-mixer rather than analyst-versus-transaction.
Additional source references: source document 1.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
