Researchers tracking the so-called third-wave Coldcard exploit reported Wednesday that the attacker swapped roughly 10% of stolen Bitcoin for Ether using THORChain, a cross-chain protocol that requires no central intermediary. According to Cointelegraph, on-chain analysts traced the funds to a new Ethereum address shortly after the swap settled.
The mechanics here matter. THORChain does not ask for identity documents or freeze suspicious wallets. That makes it useful for legitimate cross-border transfers — and, as this case shows, attractive to anyone trying to obscure the origin of funds. The protocol itself is not the vulnerability. The breach happened earlier, at the custody layer.
What Actually Failed
Coldcard is widely regarded as one of the more secure hardware wallets available. That reputation makes incidents like this worth examining closely rather than dismissing. A third-wave exploit designation suggests researchers believe multiple attack rounds have occurred, potentially targeting different users or signing configurations. The specific method has not been fully disclosed publicly, but the pattern — hardware wallet users losing funds, then watching them move through decentralized rails — points to either seed phrase exposure, supply chain tampering, or a flaw in how signing sessions were managed.
None of those failure modes are new. All of them are preventable with layered precautions: verifying device firmware before use, never entering a seed phrase on an internet-connected device, and storing seed backups physically rather than digitally.
The Broader Picture on September 3
The exploit story lands on a day when Bitcoin is trading at $78,472, up modestly on a softer U.S. dollar. According to CoinDesk, yen strength has pushed the Dollar Index lower, providing a mild tailwind for both Bitcoin and gold. The Bitcoin-gold correlation has reached a six-year high, according to Glassnode data cited by The Block, though analysts are cautious about reading too much into the equity decoupling story — similar divergences have reversed quickly in the past.
On the regulatory front, SEC Chair Paul Atkins stated publicly that he expects the Clarity Act to pass this month, according to Bitcoin Magazine. That legislation would establish clearer definitions separating securities from commodities in the digital asset space. Passage would affect how exchanges, custodians, and institutional holders structure their compliance programs — a slow-moving development, but a real one.
What Institutions Are Actually Doing
Meanwhile, Strategy's CEO Phong Le addressed the firm's decision to sell nearly 7,000 BTC in the low $60,000 range before repurchasing above $80,000. According to Decrypt, Le said the decision was driven by the company's cost of capital, not by a price call. The framing is worth noting: large holders increasingly think about Bitcoin position sizing through a treasury management lens, not a trading one.
Japan's Remixpoint made a similar concentration move. The firm sold its Ether, Solana, XRP, and Dogecoin holdings — booking a ¥117.8 million profit on most — and now holds approximately 1,506 BTC as its sole crypto asset, per Decrypt.
The Custody Takeaway
The Coldcard case is a reminder that security is not a product you buy once. It is a set of practices maintained over time. Hardware wallets reduce risk significantly compared to software alternatives, but they are not impenetrable. Seed phrase discipline, firmware verification, and physical storage of recovery information remain the unglamorous but essential work of actually protecting Bitcoin.
For donors giving Bitcoin to charitable causes, using a well-maintained wallet and verifying recipient addresses carefully before sending are the same basic disciplines — small habits that protect both personal funds and the contributions meant to reach others.