The Coldcard hacker has moved stolen Bitcoin from the Wave 3 attack for the first time, ending a period in which the funds remained dormant in the original attacker-controlled addresses.
The transactions mark a shift from earlier behavior, where the stolen Bitcoin remained untouched. The attacker has now begun moving funds across blockchains, offering the first clear indication of how the assets may be laundered beyond the original wallets.
Thorn said the Wave 3 exploiter used THORChain, a cross-chain decentralized exchange protocol, to swap stolen Bitcoin for native ETH.
The THORChain deposits carried an OP_RETURN memo and an affiliate tag of “sto” set at zero basis points. Thorn also identified differences between the software used for these transactions and the wallets associated with the July and August sweeps.
The later transactions signaled replace-by-fee, used a recent locktime, and paid higher transaction fees. Meanwhile, the first spend from Wave 3 revealed a 2-of-2 multisignature setup, with later transfers using the same structure but with different keys.
(adsbygoogle = window.adsbygoogle || []).push({});Moving BTC through THORChain and receiving ETH shifts the transaction trail from Bitcoin to Ethereum. As a result, investigators must connect activity across separate blockchains while following new destination addresses and subsequent transfers.
Thorn and other researchers are continuing to trace the transactions. Further movement could reveal whether the attacker sends the ETH to additional wallets, conducts more swaps, or transfers funds toward cryptocurrency exchanges. Most of the stolen Wave 3 Bitcoin, however, remains in the original vaults.
