Bitcoin linked to the 2026 Coldcard hardware-wallet theft has begun moving across blockchains, with about 20.5 BTC – worth roughly $1.6m – routed through THORChain into Ethereum.
The activity, recorded on 2 and 3 September, marks a shift in the investigation from largely dormant stolen funds to an active cross-chain trail.
Blockchain data provider Bitquery said 20.49703196 BTC left an address identified in its classification files as “reported”, attacker-controlled and associated with Wave 3 of the theft. The funds were then transferred through two newly created Bitcoin addresses, both of which were later emptied, according to Bitquery’s tracking data.
Bitquery places the originating address in its reported category, below the provider’s confirmed addresses. The person or group controlling the funds has not been identified, and it remains unclear whether the different waves of the theft were carried out by the same operator.
THORChain, a protocol that enables swaps between different blockchain networks, recorded 34 transactions on 2 and 3 September that moved 20.45 BTC of traced value into Ethereum.
Including two earlier transactions carried out on 2 August, the tracker recorded 36 swaps involving 20.69 BTC in total. Those two earlier swaps accounted for 0.24 BTC.
Most of the funds – 20.15 BTC across 26 swaps – were directed towards the Ethereum address 0x160a7A4c067B084F03400c6980Ac29F73F6782f6.
A further 0.30 BTC was sent through eight swaps to a second Ethereum address. The two August transactions identified by the tracker were linked to a third Ethereum address.
Bitquery’s dated transaction table includes THORChain protocol memos naming the principal destination in representative Bitcoin transactions carried out on 2 and 3 September.
The main Ethereum address held about 649.5 ETH and had not recorded any outgoing transactions when Bitquery checked it at 16:15 UTC on 3 September.
However, a balance response from Blockscout showed that the address held 644.4974 ETH by 17:25 UTC. The fall of roughly 5 ETH represented a change from the earlier snapshot, although the available data did not establish where those funds went.
At Bitcoin block 965,339, Bitquery said 1,402.59 BTC remained in identified addresses and could still be fully traced. Of that amount, 1,396.33 BTC had not moved at all.
The 20.69 BTC sent through THORChain was listed separately by the tracker as funds being watched on Ethereum.
An independent dataset based on Bitcoin block data records Waves 1, 2 and 3 separately from a 64.90373764 BTC Wave 4. It said the blockchain evidence could not determine whether the same operator was behind each wave.
Galaxy Research has also said it cannot definitively connect all of the transaction footprints associated with the different waves.
The latest swaps therefore make the Coldcard case more active from a tracking perspective. While much of the identified Bitcoin remains parked, the principal Ethereum address still held about 644.5 ETH at the latest check.
Bitcoin was up 5.42% over the previous 24 hours and remained the world’s largest cryptocurrency by market capitalisation, ranked number one.
The investigation centres on funds identified as being connected to the Coldcard hardware-wallet theft. Blockchain records can show how assets move between addresses, but they do not by themselves establish the identity of the person controlling those addresses or prove that separate transaction groups were carried out by one individual.
