Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC 
ETH Summary
Coldcard Wave 3 hackers transferred stolen bitcoins from their original addresses for the first time and exchanged some of the funds for Ethereum through THORChain to launder money.
Transaction details show that the cross-wallet control of stolen funds adopts a two-by-one multi-signature structure, and has characteristics such as replacement fee setting, recent lock-up time, and higher handling fees.
Investigators need to track activity on both the Bitcoin and Ethereum chains, while most of Wave 3 's assets are still stored untouched in the original wallet.
Coldcard Wave 3 hackers transfer stolen bitcoins for the first time
According to Alex Thorn, director of research at Galaxy Digital, the attacker used THORChain to exchange some of the stolen bitcoins for Ethereum. The deal ends a long period of silence for Wave 3 's stolen funds and reveals a possible path to money laundering. Previously, researchers had never recorded direct spending of hacker addresses related to Waves 1, 2, or 3.
The transfer provided investigators with evidence of how the attacker might have moved stolen assets out of the original Bitcoin wallet. Rather than retaining all funds in the original wallet, the attackers began to transfer value between multiple blockchain networks. As a result, investigators must connect transactions on Bitcoin and Ethereum while simultaneously identifying target wallet addresses associated with cross-chain conversions.
THORChain allows users to directly exchange native cryptocurrencies between different blockchains without packaging assets or centralized trading platforms. The protocol provides attackers with a way to directly exchange stolen bitcoins for native Ethereum by decentralizing the pool of liquidity.
Transaction details reveal changes in hacker spending methods
Thorn reported that THORChain deposits contain OP_RETURN remarks and the associated label "sto" for basis points. These details may help researchers distinguish hacker transactions from unrelated activities on decentralized trading platforms.
More importantly, Thorn found technical differences between these transactions and wallets in July and August consolidation operations. Subsequent Bitcoin transactions enabled the replacement fee function, used the recent lock-in time, and had higher fees than earlier transfers. In addition, the first Wave 3 payout exposed the pairwise multi-signature structures that control stolen bitcoins. The structure requires the Bitcoin network to obtain two separate cryptographic signatures before it can approve and process any transaction. Subsequent transfers use the same multi-signature structure, but the attacker uses a different key for authorization. These changes suggest that the attacker replaced trading software or adopted alternative asset management methods.
However, the available evidence does not determine the identity of the wallet's controller or the specific software that generated each transaction. Ethereum swaps complicate the tracing of funds because investigators must examine activity recorded on two separate public ledgers.
Researchers need to match bitcoin outflows with THORChain conversions and monitor the corresponding Ethereum address to discover more movements. Further transfers could reveal whether the attacker plans to make more conversions, split assets, or send funds to a cryptocurrency exchange. However, most of the Wave 3 stolen bitcoins are still stored in the original wallet, and a large balance is still under active investigation.
