Coldcard Attacker Reportedly Swapped About 10% of Stolen BTC via THORChain

An attacker linked to a Coldcard-related Bitcoin theft has reportedly used THORChain to swap roughly 10% of the stolen BTC, a path that can frustrate on-chain tracing and has renewed attention on how self-custody funds get laundered after leaving a hardware wallet. THORChain is a cross-chain liquidity protocol that enables swaps of native assets across networks without a custodial intermediary. In practice, that means stolen Bitcoin can be converted into other cryptoassets without touching a centralized exchange that could potentially freeze funds. This design is also why THORChain frequently appears in investigations involving self-custody compromises. Key points - An attacker tied to a Coldcard-linked theft reportedly routed around 10% of the stolen BTC through THORChain. - Cross-chain swaps can move value into other assets without a custodial choke point, making the flow harder to follow. - Parts of the report remain unconfirmed, and only a portion of the stolen BTC has been traced through the protocol so far. The incident follows earlier reporting on Coldcard-related losses. AICryptoCore previously reported that Coldcard faced a suspected fourth attack wave involving about 388.9 BTC, consistent with broader targeting of hardware-wallet users via supply-chain attacks or seed-compromise methods. Why moving only part of the BTC still matters Investigators often treat partial transfers as a meaningful signal. Moving a fraction first can function as a laundering test, helping an attacker assess liquidity, slippage, and whether monitoring or enforcement responses are likely to disrupt subsequent transfers. Because THORChain settles into native assets on destination chains, proceeds can arrive as Ethereum-based tokens. Those movements are visible on public explorers and blockchain records, creating a trade-off: the BTC trail becomes less direct, but the recipient-chain activity leaves a fresh footprint. What it means for wallet security and tracing For self-custody users, the practical lesson is straightforward: once a seed phrase or signing device is compromised, speed works in the attacker's favor. Cross-chain routing compresses the time window for exchanges or law enforcement to intervene. At the same time, AI-assisted monitoring used to defend wallets is increasingly being deployed to trace laundering flows across chains. AICryptoCore has also reported on a Bitcoin red team using Kimi AI to identify potential flaws, illustrating how machine-driven analysis is being applied on both the offensive and defensive sides of Bitcoin infrastructure. Details in this case remain partly unconfirmed, and the share of stolen funds routed through THORChain could change as investigators map more of the trail. For decentralized-AI and on-chain analytics teams, incidents like this are becoming key benchmarks for cross-chain forensic tools, where the contest is increasingly model-versus-mixer rather than analyst-versus-transaction. Additional source references: source document 1. Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.