The Coldcard Wave 3 attacker has moved stolen cryptocurrency for the first time, marking a new phase in the ongoing security incident. Galaxy Digital research chief Alex Thorn said the attacker converted part of the stolen assets into ETH through THORChain.
The movement represents the first known transfer from the original hacker addresses tied to the Wave 1, Wave 2, or Wave 3 incidents. Until now, the stolen funds had remained in their initial on-chain locations.
THORChain Activity Draws Attention
On-chain activity suggests the attacker is attempting to move a larger portion of the stolen funds through THORChain, a cross-chain decentralized exchange. However, the process has not gone smoothly.
Several swap attempts appear to have been refunded. The attacker has continued retrying transactions despite those setbacks, according to Thorn’s monitoring.
About 90% of the Wave 3 funds remain untouched. That leaves most of the stolen assets still sitting in addresses associated with the incident, even as the attacker begins testing routes for moving or converting the funds.
On-Chain Tracking Intensifies
The new activity could make the stolen assets easier to monitor because transfers create additional on-chain traces. Thorn said the resulting Ethereum address has been identified and shared with relevant authorities and cryptocurrency firms.
The movement also provides analysts with fresh information about the attacker’s behavior and the software involved in the transactions. Thorn’s analysis indicates that different tools may have been used during the vaulting, cash-out, and THORChain stages.
The Coldcard incident has involved multiple waves of wallet drains linked to compromised seed generation. The latest movement does not mean the remaining funds have been successfully liquidated, but it signals that the attacker has begun actively testing ways to move the assets.
