Coldcard hacker moves stolen Bitcoin via THORChain
THORChain (RUNE)
Editor:
Eugene Serbin
grafa.com reports that a hacker linked to the third wave of Coldcard wallet thefts has begun moving stolen Bitcoin through THORChain. Galaxy Research states the attacker moved about 10% of the stolen funds, while roughly 90% remained at the original addresses. These transfers marked the first on-chain movement from the original addresses linked to any of the three Coldcard attack waves.
On-chain analysts traced the Bitcoin through THORChain to a new Ethereum address, which has been shared with relevant authorities and crypto companies. Galaxy head of research Alex Thorn said the attacker appeared to have encountered problems completing the swaps, with some transactions refunded before being retried. The wider exploit is linked to the theft of at least 1,789 Bitcoin from 8,865 addresses.
These assets were worth about US$114.7 million when stolen. The latest movement follows reports that hackers had previously sent 64 Bitcoin and 200 Ether to crypto mixers. Coldcard has advised affected users to migrate vulnerable wallet seeds.
How the market reacted
Whalio's own Binance spot order flow for RUNE, measured when this story was written up on 4 September 2026. Not the outlet's figures.
RUNE is trading at $0.4900 with a 1-hour buy ratio of 52.9%, indicating short-term buying pressure. This contrasts with a 37.1% buy ratio over the 4-hour window, suggesting that recent buying is outpacing the broader short-term trend. The 24-hour buy ratio sits at 51.6%, showing that buying has been the dominant force over the full day. Volume delta data reveals a positive $1,852 in the last hour, while the 4-hour delta is negative at -$43,374. The 24-hour volume delta is positive at $43,487, confirming net accumulation over the day. CVD closed at -$59,694, indicating that despite the buy ratio, cumulative volume delta ended in negative territory for the period.
The latest daily buy ratio of 44.5% sits at the 5th percentile of the last 281 days, against a median of 50.4% - among the weakest buying days it has had.
Was that an ordinary day?
The same Binance spot measurements for RUNE, averaged over the days leading up to the story.
Over the preceding week, the 7-day average buy ratio was 46.5%, making today's 24-hour ratio of 51.6% an unusual day with 5.2 points more buying than average. However, spot volume was only 0.57x the average, indicating lower participation than usual. The coin saw a price change of -3.4% over the eight-day period. Volume delta for the week totaled -$597,471, showing a net outflow compared to the day's positive delta. Only one of the seven days recorded net buying, highlighting that this recent activity is a deviation from the weekly norm.