A person who claimed that hackers compromised Coldcard and forced a transfer of funds from Bitcoin to Ethereum may themselves be a threat actor, on-chain investigator Specter said. Blockchain data showed that 73 BTC, valued at $4.6 million, had originated from Whirlpool, a Bitcoin mixing service, two weeks earlier. Some of the funds later moved across chains to Ethereum and were deposited through a phishing interface impersonating Tornado Cash. The transfers involved two mixing services, and the individual was also found in Telegram groups focused on private-key searches and brute-force attacks. Specter said the funds may alternatively have been stolen by another threat actor.