Stolen Bitcoin from Coldcard hack starts moving to Ethereum

An attacker connected to the Coldcard hardware wallet theft has broken their silence by moving a significant amount of stolen funds. Blockchain data shows that 20.5 Bitcoin, previously sitting idle, was moved through a series of wallets before being routed across chains earlier this week.

The funds were moved using the THORChain protocol, which allowed the attacker to swap Bitcoin for Ethereum. Between September 2 and September 3, the attacker completed dozens of swaps to shift the value onto the Ethereum network. The bulk of these funds, roughly 644 ETH, is currently sitting in a single Ethereum wallet address.

This movement marks a major shift in the case, as the majority of the stolen Bitcoin had remained stationary for a long time. While this activity has caught the attention of blockchain trackers, the identity of the person behind the movement remains unknown. It is also unclear if this operator is the same person responsible for every wave of the original hack.

Investors and security experts are now watching the Ethereum addresses closely to see if the funds are moved to a mixer or an exchange. Despite this activity, over 1,400 Bitcoin linked to the theft still remains stationary in various wallets. For now, the market is waiting to see if this movement is a sign that the attacker is looking to cash out or simply shifting assets to avoid further tracking.