Coldcard hacker appears to use THORChain's official frontend months after wallet-screening pledge

THORChain, the cross-chain liquidity protocol, said its official swap site would screen out bad actors. A Coldcard hacker now appears to have used it anyway.

• The hacker behind the third major wave of Coldcard wallet thefts appears to have routed stolen bitcoin through THORChain's official swap interface, months after the cross-chain protocol said it planned to add wallet screening specifically to deter illicit users.
• Alex Thorn, head of firmwide research at Galaxy Digital, said in a Thursday post on X that the Wave 3 exploiter moved stolen funds for the first time, swapping roughly 10% of the stash into ETH through THORChain while about 90% remained untouched.

• It was also the first movement directly from the original hacker addresses associated with any of the three major Coldcard attack waves, according to Thorn.

The STO clue

The more unusual detail was buried in the transactions themselves as Thorn said THORChain deposits made by the hacker contained the affiliate name sto in their transaction memos, which he said identifies the frontend used for the swaps.

• THORChain itself identifies STO as the THORName for swap.thorchain.org, its official swap interface.
• The thing is that THORChain said in a January roadmap that wallet screening "will be added" to the interface to try to prevent bad actors from using it.

As recently as Aug. 12, THORChain was promoting STO as a way to make walletless cross-chain swaps with no signup or KYC.

Hacker starts moving

The movement comes more than a month after attackers began exploiting weak seed generation in some Coldcard hardware-wallet firmware.

Galaxy Research said in August that it had confirmed about 1,779 BTC, then worth roughly $112.7 million, stolen from more than 8,600 addresses, with multiple attackers believed to have exploited the vulnerability. Most of the stolen BTC had remained largely dormant.

• Thorn said the Wave 3 operator also repeatedly ran into refunds while attempting the THORChain swaps and kept retrying.
• Transaction fingerprints suggested the wallet used to cash out BTC differed from the software that originally swept the stolen funds, potentially pointing to either one operator using multiple tools or more than one person.
• The resulting ETH remains traceable. Thorn said he had shared the new Ethereum address with relevant authorities and crypto firms.