Stolen Coldcard Bitcoin Moves to Ethereum via THORChain Swaps

Bitcoin flagged by blockchain data provider Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash began moving. The route shifted the case from a largely parked stash to an active cross-chain trail.

The Sept. 2 activity began when 20.49703196 BTC left an address that Bitquery's classification file lists as “reported,” attacker-controlled and tied to Wave 3. The funds passed through two fresh Bitcoin addresses, both later emptied, according to the tracker's movement data.

Bitquery places the origin in its reported tier, below its confirmed addresses. The controller remains unidentified, and links between the wider drain waves remain unresolved.

THORChain is a cross-chain swap protocol. The live tracker recorded 34 swaps on Sept. 2–3 that routed 20.45 BTC of traced value into Ethereum. Its broader total was 20.69 BTC across 36 swaps because it also included two earlier swaps totaling 0.24 BTC on Aug. 2.

Most of the total, 20.15 BTC across 26 swaps, was routed toward 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC went through eight swaps to a second Ethereum address, while the two August swaps named a third.