{"id":12802,"date":"2026-09-04T08:15:12","date_gmt":"2026-09-04T08:15:12","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12802"},"modified":"2026-09-04T08:15:12","modified_gmt":"2026-09-04T08:15:12","slug":"coldcard-hacker-starts-swapping-stolen-bitcoin-for-ether","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12802","title":{"rendered":"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_679a1eda03390a71033fa2ed0bea8d0e\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Galaxy Research head of research Alex Thorn said on Sept. 3 that a hacker linked to the third wave of the Coldcard thefts moved about 20.5 Bitcoin, roughly 10% of that wave\u2019s stolen funds, and started swapping it for Ether through THORChain.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The swaps repeatedly failed, with about 17.7 Bitcoin refunded, and the proceeds reached a new Ethereum address that Galaxy said it shared with law enforcement and major crypto firms.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">It is the first onchain movement from any of the three theft waves; Galaxy has traced 1,789 Bitcoin stolen from 8,865 addresses.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">A hacker linked to the third wave of the Coldcard wallet thefts has started moving the stolen Bitcoin, converting some of it to Ether through the cross-chain protocol THORChain. It is the first time funds from any of the three theft waves have left the original attacker addresses.<\/p>\n<p class=\"wp-block-paragraph\">Galaxy Research head of research Alex Thorn reported the movement on Sept. 3. The hacker shifted about 20.5 Bitcoin, or roughly 10% of the third wave\u2019s stolen coins, leaving about 90% of that wave untouched. Galaxy has said the third wave should not be assumed to involve the same attacker as the earlier ones.<\/p>\n<p class=\"wp-block-paragraph\">The swaps did not run cleanly. Galaxy traced the coins through a series of intermediary wallets before they reached THORChain, where about 17.7 Bitcoin was refunded during the attempts before the funds went through.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe hacker appears to be having some issues swapping all the funds through THORChain, they keep getting refunded and he keeps retrying\u201d, Thorn said. The proceeds reached a new Ethereum address, which Galaxy said it passed to law enforcement and major crypto firms.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Robinhood Chain Nears $1B DEX Volume as TVL and Stablecoin Liquidity Surge<\/strong><\/p>\n<h2 id=\"h-the-firmware-defect-behind-the-thefts\" class=\"wp-block-heading\">The Firmware Defect Behind the Thefts<\/h2>\n<p class=\"wp-block-paragraph\">The thefts trace to a defect in Coinkite\u2019s Coldcard, an air-gapped Bitcoin hardware wallet.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">A firmware change made in March 2021 routed seed generation through faulty code that produced far too little randomness, and Coinkite has said some seeds carried as little as about 40 bits of entropy instead of the intended 128, leaving the private keys guessable. Attackers began draining wallets on July 30, taking 1,082 Bitcoin from 1,196 addresses in about 41 minutes in the first wave, according to Galaxy.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Coinkite shipped emergency firmware the next day, but the patch does not repair a seed already created, and the company has told affected users to move their coins to a newly generated one.<\/p>\n<p class=\"wp-block-paragraph\">Galaxy has traced 1,789 Bitcoin (US$114.7 million \/ AU$159 million) stolen from 8,865 addresses at the time of the theft, across at least three waves and at least 15 separate attackers. Its count rests on 221 victim reports covering 790.72 Bitcoin, with the remaining addresses identified through onchain analysis.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">CNA reported the exploit reaching as much as US$130 million (AU$181 million) in early August, before Galaxy narrowed its confirmed tally. Those coins had sat untouched for about five weeks before this week\u2019s transfers, and funds from the first two waves have not moved at all.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Bitcoin Treasury Titans Reload: Strive and Strategy Add $513M in BTC<\/strong><\/p>\n<\/p><\/div>\n<p>Bitcoin,Hackers,THORChain#Coldcard #Hacker #Starts #Swapping #Stolen #Bitcoin #Ether1788509712<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Galaxy Research head of research Alex Thorn said on Sept. 3 that a hacker linked to the third wave of the Coldcard thefts moved about 20.5 Bitcoin, roughly 10% of that wave\u2019s stolen funds, and started swapping it for Ether through THORChain. The swaps repeatedly failed, with about 17.7 Bitcoin refunded, and the proceeds reached<\/p>\n","protected":false},"author":1,"featured_media":12803,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[91,5845,1165,2670,542,2671,6415],"class_list":["post-12802","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-bitcoin","tag-coldcard","tag-ether","tag-hacker","tag-starts","tag-stolen","tag-swapping"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12802\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether\" \/>\n<meta property=\"og:description\" content=\"Galaxy Research head of research Alex Thorn said on Sept. 3 that a hacker linked to the third wave of the Coldcard thefts moved about 20.5 Bitcoin, roughly 10% of that wave\u2019s stolen funds, and started swapping it for Ether through THORChain. The swaps repeatedly failed, with about 17.7 Bitcoin refunded, and the proceeds reached\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12802\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-04T08:15:12+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12802\",\"name\":\"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg\",\"datePublished\":\"2026-09-04T08:15:12+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12802\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg\",\"width\":1920,\"height\":1047},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12802#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12802","og_locale":"en_US","og_type":"article","og_title":"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether","og_description":"Galaxy Research head of research Alex Thorn said on Sept. 3 that a hacker linked to the third wave of the Coldcard thefts moved about 20.5 Bitcoin, roughly 10% of that wave\u2019s stolen funds, and started swapping it for Ether through THORChain. The swaps repeatedly failed, with about 17.7 Bitcoin refunded, and the proceeds reached","og_url":"https:\/\/cryptonews.uk.com\/?p=12802","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-04T08:15:12+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12802","url":"https:\/\/cryptonews.uk.com\/?p=12802","name":"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg","datePublished":"2026-09-04T08:15:12+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12802#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12802"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12802#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/cold-hacker-btc-eth.jpg","width":1920,"height":1047},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12802#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Coldcard Hacker Starts Swapping Stolen Bitcoin for Ether"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12802","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12802"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12802\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12803"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12802"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12802"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12802"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}