On-chain detective Specter said a person claiming to have been hacked through Coldcard moved funds from Bitcoin to Ethereum, but on-chain data showed the 73 BTC came from the Whirlpool mixer two weeks earlier. According to Odaily, part of the funds were bridged to Ethereum and later deposited through a phishing Tornado Cash interface, with two mixers used during the transfer process.

Specter also said the person was found in Telegram groups related to private key searches and brute-force cracking. Specter said the victim may instead be a threat actor, and the funds may have been stolen by another threat actor.