Bitquery tracks 20.5 BTC stolen funds flowing into Ethereum through THORChain redemption

There is active cross-chain flow of bitcoins related to the 2026 Coldcard hardware wallet theft

As blockchain analysis provider Bitquery traced 20.5 bitcoins transferred to the Ethereum network through the THORChain protocol, previously dormant funds related to the 2026 Coldcard hardware wallet theft have once again surfaced. This trend marks an important progress in the investigation into this high-profile cryptocurrency theft case.

Active cross-chain transfer of stolen funds

The transfer began on September 2, when 20.49703196 bitcoins were transferred from a previously confirmed address. The address was described by Bitquery as part of the "third wave" of operations from the Coldcard event. After passing through two new intermediate Bitcoin addresses that were cleared in the process, the funds began a complex cross-chain redemption journey.

Bitquery marks the source address as "reported", indicating that it is related to the known case, but has not yet reached its maximum verification level. At present, the identity of the main body controlling these funds is still unclear, resulting in investigators lacking clear suspects clues.

This activity shifted the focus of the investigation from long-standing stolen bitcoins to an active cross-chain trajectory. This is the first time since the theft that Bitquery has traced the transfer of these coins from the Bitcoin network to the Ethereum network.

Researchers said that prior to the move, most of the stolen bitcoins remained untouched for a long time, further concealing the source and intentions of the people involved.

Tracking Bitcoin diversion through THORChain conversion

As a decentralized cross-chain protocol that allows the exchange of cryptographic assets between different blockchain networks, THORChain handled a series of 34 redemption operations on September 2 and 3, transferring 20.45 bitcoins to the Ethereum network.

Bitquery's complete tracking records show that a total of 20.69 bitcoins were redeemed in 36 operations, including two earlier conversions on August 2, with a total value of 0.24 bitcoins. Most of the assets-20.15 bitcoins-flowed into a single Ethereum address through 26 conversions, and another 0.3 bitcoins flowed into a second address through eight additional conversions. Two other conversions in August directed funds to a third Ethereum address.

Records show that THORChain's exchange remarks specify the target address for the main flow of traffic in September. As of 16:15 UTC on September 3, the balance of the main recipient's Ethereum address was approximately 649.5 ETH, and no outgoing transactions were shown. By 17:25 UTC, new activity reduced the balance by approximately 5 ETH, the first out-of-account transaction since funds were received.

Noun explanation: THORChain is a decentralized liquidity protocol that allows users to exchange assets across different blockchains without relying on a centralized exchange, providing cross-chain interoperability.

The vast majority of stolen bitcoins are still dormant

Despite the recent activity, most of the bitcoins stolen in the Coldcard vulnerability have not yet been moved. At block height of 965,339, investigators reported that 1,402.59 bitcoins remained at addresses identified as related to the theft. Of these, 1,396.33 bitcoins never left their original stolen addresses, further exacerbating the opacity about the final destination of most stolen assets.

The blockchain dataset divides Coldcard robberies into several "waves" based on block data. The first to third waves were tracked separately, while the fourth wave involved 64.90373764 bitcoins. Researchers at Bitquery and Galaxy Research warned that blockchain evidence alone cannot determine whether these thefts were committed by the same criminals or gangs.

Digital asset and blockchain analysis firm Galaxy Research estimates that the total loss from the Coldcard hardware wallet theft exceeds 1,700 bitcoins. The status of the main Ethereum address associated with the September redemption is still being monitored, with a balance of approximately 644.5 ETH, while the vast majority of stolen bitcoins are still classified as dormant.

Researchers, including Galaxy Research, emphasized that they were unable to determine whether individual behavior or collective responsibility was behind each wave of Coldcard wallet thefts, highlighting the continuing uncertainty investigators face.