The hacker tied to the 'third wave' Coldcard incident swapped a chunk of the stolen bitcoin for ether using THORChain. Blockchain analysts estimate roughly 10% of the loot moved through the protocol. The transferred funds were tracked all the way to a fresh address on Ethereum.

What went down

The attacker converted BTC to ETH via THORChain, then sent the ETH to a brand-new Ethereum address. Researchers mapped the whole route, linking it directly to the 'third wave' Coldcard exploit.

How the funds moved

Here’s the play-by-play: BTC got swapped for ETH on THORChain, then the ETH was pushed into the Ethereum ecosystem. Current estimates put the value moved at about 10% of the total stolen stash.

Where things stand now

Both BTC and ETH played a role in the flow of funds. Investigators say the trail leads to a new Ethereum address, with the THORChain swap as the bridge. No other confirmed details are available at this time.