According to CoinMeta, as reported by Alex Thorn, the third wave of hackers involved in the Coldcard wallet theft began converting the stolen Bitcoins to Ethereum through Thorchain on September 3. This transaction moved approximately 10% of the Bitcoins controlled by the attackers, with about 90% of the Bitcoins still remaining at the original address. Researchers traced a newly identified Ethereum address through Thorchain and have shared this address with law enforcement agencies and crypto companies that monitor stolen assets. Thorchain allows users to exchange native assets between blockchains without having to deposit funds into centralized exchanges. This transfer of funds is the first time such a move has been made directly from the original hacker’s address on-chain. Analysts will continue to monitor whether these funds will be transferred to centralized exchanges, bridges, or privacy services.