A person claiming that hackers attacked Coldcard and forced the transfer of funds from Bitcoin to Ethereum may instead be a threat actor, according to on-chain investigator Specter. Blockchain data showed that 73 BTC worth $4.6 million had originated from the Whirlpool crypto mixer two weeks earlier. Some of the funds then moved across chains to Ethereum and were deposited through a phishing Tornado Cash interface. The transfers involved two mixers. The individual was also found in Telegram groups focused on private-key searching and brute-force attacks. Specter said the funds may have been stolen by another threat actor, leaving the circumstances unresolved.