Coldcard Wave 3 Attacker Moves Stolen Funds via THORChain to ETH

The perpetrator behind the Coldcard Wave 3 security breach has initiated the first movement of illicitly obtained assets since the attack took place. According to data monitored on the blockchain, the attacker has begun transferring funds from their original wallet address to various on-chain destinations. This development marks a significant shift in the post-exploit phase, as assets from previous Wave 1 and Wave 2 events had remained largely stagnant until this recent activity.

Asset Conversion and THORChain Activity

Analysis provided by Alex Thorn, Head of Research at Galaxy Digital, reveals that the attacker is actively utilizing the decentralized liquidity protocol THORChain to obfuscate the trail of stolen capital. The primary objective appears to be the exchange of stolen assets for Ethereum (ETH). However, the process has not been entirely seamless for the malicious actor.

• The attacker initiated the first-ever transfer from the initial Wave 3 deposit address.
• Multiple attempts to swap funds through THORChain resulted in repeated refunds, suggesting technical hurdles or protocol safeguards.
• Despite these setbacks, the attacker continues to persist in executing further exchanges.

Status of the Stolen Capital

While the movement of funds indicates an attempt to launder or liquidate the proceeds of the exploit, a substantial portion of the loot remains under monitoring. On-chain forensics suggest that approximately 90% of the Wave 3 stolen funds are still sitting in the original addresses, untransferred. The Wave 3 attack is part of a series of exploits targeting users of hardware wallet-related services, highlighting ongoing security challenges within the cold storage ecosystem.

The crypto community and security researchers continue to track the movement of these assets as the attacker attempts to navigate decentralized finance (DeFi) protocols to convert holdings. While the technical issues encountered during the THORChain swaps have slowed the liquidation process, the intent to move the remaining 90% of the funds remains clear. Security experts advise heightened vigilance and the use of robust privacy measures when managing hardware wallet configurations.