TLDR
- A 20.5 BTC stash linked to the 2026 Coldcard hardware wallet theft moved through 34 THORChain swaps into Ethereum on September 2 and 3.
- Bitquery traced the funds from a “reported” attacker address tied to what it calls Wave 3 of the theft.
- Most of the traced value, 20.15 BTC, landed at one Ethereum address that later showed an outgoing drop of about 5 ETH.
- Most of the stolen Bitcoin, over 1,400 BTC, remains parked and untouched in identified addresses.
- Researchers including Galaxy Research say they still cannot confirm whether all theft waves trace back to one person or group.
A stash of Bitcoin linked to the 2026 Coldcard hardware wallet theft began moving this week. Blockchain data provider Bitquery tracked the funds as they crossed into Ethereum.
The move shifted the case from a mostly parked stash of stolen coins into an active cross-chain trail. Investigators had watched much of the stolen Bitcoin sit untouched for months.
The activity started on September 2 when 20.49703196 BTC left an address linked to the theft. Bitquery’s classification file lists the address as reported and tied to what it calls Wave 3.
The coins passed through two fresh Bitcoin addresses. Both were later emptied, according to Bitquery’s tracking data.
Bitquery places the origin address in its reported tier, one step below its confirmed list. The person or group controlling the funds has not been identified.
Bitcoin Routes Through THORChain to Ethereum
THORChain is a tool that lets users swap coins across different blockchains. Bitquery’s live tracker recorded 34 swaps on September 2 and 3 that sent 20.45 BTC of traced value into Ethereum.
The tracker’s broader total reached 20.69 BTC across 36 swaps. That figure includes two earlier swaps worth 0.24 BTC that happened back on August 2.
Most of the funds, 20.15 BTC across 26 swaps, ended up at one Ethereum address. A smaller amount, 0.30 BTC, moved through eight swaps to a second address.
The two August swaps sent funds to a third address. Bitquery’s records show THORChain swap memos naming the main destination for the September transactions.
That main Ethereum address held about 649.5 ETH with no outgoing transactions when Bitquery checked at 16:15 UTC on September 3. About an hour later, at 17:25 UTC, a balance check showed 644.4974 ETH.
The drop of roughly 5 ETH marked the first outgoing activity from that address since the funds arrived.
Most Stolen Bitcoin Remains Untouched
Not all of the stolen Bitcoin has moved. At block 965,339, Bitquery counted 1,402.59 BTC still sitting in identified addresses linked to the theft.
Of that total, 1,396.33 BTC has never moved since it was stolen. Bitquery tracks the 20.69 BTC that went through THORChain as a separate category, now watched on Ethereum.
A separate dataset built from Bitcoin block data breaks the theft into waves. It counts Waves 1 through 3 apart from a fourth wave of 64.90373764 BTC, and says the blockchain alone cannot confirm whether one group is behind all of them.
Galaxy Research has also said it cannot fully link every wave of the theft to a single source. The firm has estimated total losses from the Coldcard theft at 1,700 BTC or more.
As of the latest check, the main Ethereum address tied to the September swaps still held about 644.5 ETH. The rest of the traced Bitcoin has yet to move beyond the two Bitcoin addresses used in the swap.
