Coldcard Wave 3 Attacker Swaps 4.2 BTC for ETH on THORChain
THORChain (RUNE)
Editor:
Eugene Serbin
newsbitcoin.cash reports that the attacker behind the Coldcard Wave 3 campaign has moved stolen Bitcoin for the first time since the incident. Approximately 4.2 BTC was converted into 135 ETH via the THORChain protocol, marking a shift from dormant funds to active obfuscation. This cross-chain swap allows the attacker to diversify assets and complicate blockchain forensics by routing funds through a permissionless liquidity layer.
The attacker tested multiple routes within THORChain before executing the successful conversion, suggesting a deliberate probe of the infrastructure. This behavior aligns with a pattern where high-profile exploit proceeds remain static before attackers move them when conditions seem favorable. The modest size of the 4.2 BTC swap likely serves as a test of on-chain monitoring response times rather than the total stolen amount.
By emerging as ETH, the funds can now be fragmented or deposited into DeFi protocols to further obscure their trail. THORChain continues to serve as a primary escape route for bad actors, despite its own security incidents and history in other breaches. The movement reopens questions about hardware wallet security and the regulatory exposure of censorship-resistant DeFi infrastructure. This activity signals that the organized threat actor is actively pursuing ways to launder proceeds from the third wave of attacks.
How the market reacted
Whalio's own Binance spot order flow for RUNE, measured when this story was written up on 4 September 2026. Not the outlet's figures.
RUNE is trading at $0.4900 with a 24-hour buy ratio of 51.6%, indicating a slight majority of buy-side volume over the full day. However, the 1-hour buy ratio has risen to 51.8%, showing that immediate buying pressure is building compared to the 4-hour ratio of 43.9%. The 1-hour volume delta is positive at +$1,719, while the 4-hour delta is negative at -$47,876, suggesting recent momentum is shifting toward buyers after a shorter-term sell-off. The 24-hour CVD closed at -$119,709, meaning that over the last day, sell volume outweighed buy volume by that amount. This divergence between the rising 1-hour buy ratio and the negative daily CVD indicates that while recent trades are favoring buyers, the broader daily trend remains net selling.
The latest daily buy ratio of 44.5% sits at the 5th percentile of the last 281 days, against a median of 50.4% - among the weakest buying days it has had.
Was that an ordinary day?
The same Binance spot measurements for RUNE, averaged over the days leading up to the story.
Over the preceding week, the 7-day average buy ratio was 46.5%, making today's 24-hour ratio of 51.6% an unusual day with 5.2 more points of buying pressure than the weekly average. Spot volume for the day was $1,408,115, which is 0.57x the weekly average, indicating that trading activity is significantly lower than usual. The weekly volume delta total was -$597,471, contrasting with the day's positive 1-hour delta but aligning with the negative 24-hour CVD. Price has declined 3.4% over the 8-day period, and net buying occurred on only 1 of the 7 days. This suggests that despite a brief uptick in buying ratios, the coin remains in a broader downtrend with subdued volume relative to its weekly norms.