Coldcard theft loot moves to Ethereum via THORChain swaps

Blockchain analytics firm Bitquery identified a movement of roughly 20.5 BTC that had been linked to a 2026 Coldcard hardware‑wallet theft. The funds, previously parked in Bitcoin addresses, were swapped into Ethereum over two days, turning a dormant stash into an active cross‑chain trail.

Initial Bitcoin outflow

On September 2, 20.49703196 BTC left an address flagged by Bitquery as “reported” and attacker‑controlled, associated with the third wave of the theft. The coins passed through two newly created Bitcoin addresses, both of which were subsequently emptied.

Cross‑chain swapping via THORChain

The live tracker recorded 34 swaps on September 2–3 that moved 20.45 BTC into Ethereum through the THORChain protocol. Including two earlier swaps on August 2, the total swapped amount reached 20.69 BTC across 36 swaps.

• 26 swaps (20.15 BTC) sent to Ethereum address 0x160a7A4c067B084F03400c6980Ac29F73F6782f6.
• Eight swaps (0.30 BTC) sent to a second Ethereum address.
• The two August swaps involved a third Ethereum address.

Ethereum destination balance

The primary Ethereum address held approximately 649.5 ETH at the 16:15 UTC snapshot on September 3. By 17:25 UTC, the balance had decreased to about 644.5 ETH, indicating a modest outflow of roughly 5 ETH.

Remaining Bitcoin holdings

At Bitcoin block 965,339, Bitquery identified 1,402.59 BTC still residing in known addresses, including 1,396.33 BTC that had never moved. The swapped 20.69 BTC were tracked separately as Ethereum‑linked funds.

Unresolved links

While the movement connects the stolen Bitcoin to Ethereum, the identity of the controller remains unknown, and analysts have not confirmed whether the same actor is responsible for earlier theft “waves.”