The Coldcard Wave 3 hacker moved stolen funds on-chain for the first time. The funds were swapped into Ethereum via THORChain. The activity was identified by Galaxy’s Head of Research, Alex T
The Coldcard Wave 3 hacker has moved stolen cryptocurrency on-chain for the first time since the incident, according to Galaxy Head of Research Alex Thorn.
The transaction involved swapping the stolen assets into Ethereum (ETH) through THORChain, a cross-chain decentralized liquidity protocol. The movement marks the first known on-chain activity involving the stolen funds, drawing attention from blockchain analysts and investigators monitoring the wallets.
Such transactions are often closely tracked as they may provide clues about how stolen assets are being managed or laundered.
According to Thorn, the attacker used THORChain to convert the stolen funds into Ethereum.
Cross-chain protocols enable users to exchange assets across different blockchains without relying on centralized exchanges. While these protocols serve legitimate purposes, they can also be used by attackers attempting to move or obscure stolen funds across multiple networks.
Blockchain analytics firms and security researchers will likely continue monitoring the associated wallet addresses for further activity.
UPDATE: Coldcard wave 3 hacker moved stolen funds onchain for the first time, swapping them to ETH through THORChain, says Galaxy's Alex Thorn. pic.twitter.com/XPPR6ouSuf
— Cointelegraph (@Cointelegraph) September 3, 2026
The latest Coldcard hacker funds movement highlights the importance of blockchain transparency in tracking illicit transactions.
Although the attacker has begun moving assets, every on-chain transaction creates a public record that investigators can analyze. Security firms, exchanges, and compliance teams are expected to continue monitoring the wallets for additional transfers and potential attempts to cash out the stolen cryptocurrency.
