Coldcard hacker swaps stolen BTC for THORChain

Alex Thorn of Galaxy Research says that a hacker involved in the third Coldcard wallet heist began converting stolen Bitcoin to Ether via THORChain as early as Sept. 3.

Thorn controlled about 10% of Bitcoin. said. About 90% of the original address remained when he posted his update.

Researchers tracked the swaps via THORChain through a newly-identified Ethereum address. Thorn told us he had shared this address with the law enforcement agencies, cryptocurrency companies, and organizations that were monitoring stolen assets.

Coldcard hacker fails THORChain trades

THORChain enables the users to swap native assets without having funds deposited in a central exchange. This protocol allows users to convert Bitcoin natively into Ether, without having to rely on an exchange platform.

Not all transactions were successful. Thorn claimed that it appeared the hacker was having technical issues while processing the swaps.

“The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” Thorn said

No immediate explanation was given for the reason of refunds. There are many possible explanations for the refunds. These include transaction settings, protocol safeguards or liquidity limits. However, no technical analysis has been conducted to verify their cause.

Thorn says that the movement was the first onchain transfer detected from addresses linked to the initial three attacks waves. The analysts will monitor if the ETH resulting from these attacks moves towards centralized exchanges and bridges, or to privacy services.

Galaxy traces 1,789 Bitcoins to thefts

Galaxy Research attributed the Coldcard vulnerability to the loss of 1 789,28 BTC from 8,865 different addresses. When the Bitcoins were stolen, they had a value of approximately $114.7million.

As Crypto.news has previously reported. approximately 87% of the identified Bitcoin remained unmoved As of August 25. This estimate includes funds associated with multiple attacks, attack waves and wallets that use THORChain.

Galaxy’s numbers are based in part on 221 reports of victims covering 790,72 BTC. The Onchain Analysis identified other affected addresses outside of those directly reported to customers.

Total remains an estimation because different patterns have been identified by researchers with various levels of confidence. Galaxy distinguishes its high confidence attribution of the vulnerability from addresses which may be related to it.

Previous attackers have used Bitcoin mixers

The latest THORChain transactions are different from the earlier money laundering carried out by other attackers. CertiK published in August a report that wallets connected to the incident as a whole sent 64 BTC, 200 ETH and cryptocurrency mixers.

Crypto.news has found in a related article that one attacker retained 1,159 BTC while another began mixing smaller amounts. The various movements may indicate that multiple parties exploited a similar weakness.

While mixers and chain swaps may complicate the tracking of funds, they don’t make them untraceable. The investigators are able to continue tracking transfers even when assets leave and enter public protocols.

The central exchanges, which conduct checks on identity and sanctions, are potential intervention points. Thorn confirmed that the Ethereum destinations had been sent to companies in order for them to be able identify any subsequent deposits.

Even Coldcard users need to purchase new wallet seeds

The theft has been linked to the weak seed generation of Coldcard firmware, which was released in 2021. A vulnerability in the Coldcard firmware released after 2021 reduced randomness, which protected some wallet credentials. Attackers could then calculate private keys by calculating the seed.

Coinkite is the manufacturer of Coldcard. They have released updated firmware for all affected models. The current security of the card guidance States that have previously produced vulnerable seeds require migration.

The seed generated under affected software is not repaired by installing updated firmware. The user must create a seed using the corrected firmware, and then transfer Bitcoins to an address controlled by this new wallet.

The attacker also continued to be active even after the biggest thefts had stopped. According to reports, on Aug. 29 an address associated with the operation stole Bitcoins from a researcher’s wallet that was deliberately compromised. Thorn. Researchers developed the wallet in order to see if the attackers continued their search for private keys that were predictable. The wallet’s rapid compromise showed that automated scanning was still active one month after large thefts.

It has prompted a more thorough examination of the way hardware wallets produce recovery phrases. Coldcard attacks were not like phishing, where victims had to reveal their credentials or approve the transactions. Because the seeds were not sufficiently random, attackers could derive keys and fund addresses remotely. As explained by crypto.news, the firmware flaw weakened seeds generated on affected devicesThis means that secure storage techniques cannot be used to protect money tied to these credentials.

Galaxy investigators and others are likely to keep an eye on the Ethereum address. The attacker was not publicly identified, arrested or recovered when the transfer reports were made.