Overview
- Blockchain trackers and researchers recorded roughly 20.45 BTC moved through about 34 THORChain swaps beginning Sept. 2 and Sept. 3, marking the first on‑chain movement from addresses tied to the early Coldcard theft waves.
- Galaxy Research and Bitquery said the moved amount equals about 10% of a single Wave 3 operator’s traced stash while roughly 90% of that operator’s Bitcoin and more than 1,400 BTC linked to the broader incident remain parked and untouched.
- Analysts traced most of the swapped value to a newly identified Ethereum address that now holds several hundred ETH and have shared that address with law enforcement, exchanges and crypto firms for monitoring.
- The attacker experienced repeated failed THORChain swaps that were refunded and retried, and trackers logged a small outgoing change of about 5 ETH from the main destination after the swaps arrived.
- The theft stems from a 2021 Coldcard firmware change that weakened recovery‑seed randomness, Coinkite says fixed firmware is available but users must create new seeds on patched devices and move funds because updates do not secure already generated vulnerable seeds.