Coldcard Bitcoin stolen funds are transferred to Ethereum through THORChain redemption

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

Bitcoin is routed to Ethereum through THORChain

Most of the stolen bitcoins remain intact

The 20.5 BTC fund pool related to the 2026 Coldcard hardware wallet theft was transferred to Ethereum through 34 THORChain exchanges between September 2 and 3. Blockchain data provider Bitquery traced the funds to a suspect's address marked as "reported" and linked to a "third wave" of activity in the theft.

Of the funds traced, the vast majority (20.15 BTC) flowed into the same Ethereum address, which later showed an outflow of approximately 5 ETH. However, the main stolen bitcoin, with more than 1,400 BTC, remains at the identified address, stationary and untouched.

Researchers, including Galaxy Research, said it is not yet possible to confirm whether all waves of theft originated from the same person or group.

Moving from static storage to cross-chain tracking

This week, a bitcoin linked to the 2026 Coldcard hardware wallet theft began to move. Blockchain data provider Bitquery documented the transfer of these funds across the chain to Ethereum. This development has transformed the nature of the case from a long-term static storage of stolen coins to an active cross-chain tracking clue. Previously, investigators observed that a large number of stolen bitcoins had been parked in place for months.

The activity began on September 2 when 20.49703196 BTC was transferred from an address related to the theft. According to Bitquery's classification documents, the address is classified as "reported" and is linked to what it calls a "third wave" of theft. Funds first passed through two new Bitcoin addresses, both of which were subsequently cleared, as confirmed by Bitquery tracking data.

Bitquery classifies the starting address as a "reported" level, below its "confirmed" list. Currently, the identity of the individuals or groups controlling these funds has not yet been identified.

THORChain as a cross-chain bridge

THORChain is a tool that allows users to exchange tokens between different blockchains. Bitquery's real-time tracker records show that 34 swaps occurred between September 2 and 3, transferring funds worth 20.45 BTC into Ethereum. Broader statistics from the tracker show that a total of 36 exchanges were involved, totaling 20.69 BTC. This figure also includes two earlier swaps that occurred on August 2, amounting to 0.24 BTC.

Most of the funds (20.15 BTC, exchanged in 26 times) end up being pooled into the same Ethereum address. The smaller amount (0.30 BTC, exchanged in 8 times) flows to the second address. Two other August exchange funds went to a third address. Bitquery records show that THORChain's exchange memorandum lists the main destinations for September transactions.

As of 16:15 UTC on September 3, when Bitquery checked, this main Ethereum address held approximately 649.5 ETH and had no transaction records. About an hour later, at 17:25 UTC, a balance check showed 644.4974 ETH remaining at the address. This decrease of approximately 5 ETH marks the first outflow activity from the address since funds were deposited.

The vast majority of stolen bitcoins remain static

Not all stolen bitcoins have been moved. At a block height of 965,339, Bitquery counted that 1,402.59 BTC remained in the identified addresses associated with the theft. Among them, 1,396.33 BTC has never been moved since it was stolen. Bitquery separately classifies the 20.69 BTC transferred through THORChain and continuously monitors it on Ethereum.

Another dataset built based on Bitcoin block data divides theft into multiple stages. It calculated the first to third waves and the fourth wave (64.90373764 BTC) respectively, and pointed out that blockchain data alone cannot confirm whether these waves were caused by the same gang. Galaxy Research also said it is currently unable to fully trace all waves of theft to a single source. The company estimates the total loss from the Coldcard theft to exceed 1,700 BTC.

As of the latest inspection, the main Ethereum address related to September swap operations still holds approximately 644.5 ETH. The remaining traced bitcoins have not yet exceeded the range of two bitcoin addresses used for the exchange.