Stolen Coldcard Bitcoin Moves to Ethereum in $1.6M Cross-Chain Shift

Bitcoin once left untouched after the 2026 Coldcard hardware wallet theft has abruptly reentered the spotlight. This week, blockchain data revealed that 20.5 BTC-valued at roughly $1.6 million-was moved through a series of 34 swaps on THORChain, landing in Ethereum wallets and reigniting a case that had gone cold for months.

Cross-Chain Maneuver

The sudden activity began on September 2, when funds traced to an address flagged by Bitquery as "reported" and attacker-controlled were transferred out. The BTC was routed through two newly created Bitcoin addresses, both of which were quickly emptied. From there, the coins were funneled through THORChain, a decentralized protocol designed for cross-chain swaps, and converted into Ethereum. The process involved 34 swaps over two days, with the majority-20.15 BTC-ending up in a single Ethereum address (0x160a7A4c067B084F03400c6980Ac29F73F6782f6). A smaller portion was split between two other Ethereum addresses, including two earlier swaps totaling 0.24 BTC on August 2.

On-Chain Evidence and Unanswered Questions

Bitquery's live tracker mapped the movement in detail, showing the 20.5 BTC passing through the swap protocol and into Ethereum-linked wallets. At 16:15 UTC on September 3, the principal Ethereum address held 649.5 ETH, with a slight decrease to 644.5 ETH an hour later, according to Blockscout. Despite the transparency of these transfers, the identity of the controller remains unknown, and investigators have yet to connect this wave of movement to other thefts in the broader Coldcard incident. Bitquery's classification places the origin address in a "reported" tier, indicating suspicion but not full confirmation of attacker control.

Scale of the Theft

At Bitcoin block 965,339, Bitquery reported that 1,402.59 BTC tied to the Coldcard theft remains in identified addresses, with 1,396.33 BTC still unmoved since the original incident. The 20.69 BTC that crossed into Ethereum is now being tracked separately, highlighting the evolving tactics of those behind the theft. Independent datasets continue to separate the various "waves" of the Coldcard drain, with no definitive evidence linking all activity to a single operator. Galaxy Research has also stated it cannot conclusively connect the footprints of each wave.

Implications for Security and Recovery

The shift from dormant Bitcoin to active cross-chain swaps complicates any potential recovery efforts. Once funds move from Bitcoin to Ethereum via decentralized protocols like THORChain, tracing and freezing assets becomes significantly more difficult. This mirrors challenges seen in other high-profile crypto thefts, such as those reported earlier, where cross-chain movement and rapid swaps undermine legal and technical interventions. For U.S. users and exchanges, the incident underscores the persistent risks of hardware wallet compromise and the limitations of blockchain transparency when attackers leverage interoperability tools.

According to Bitquery, the principal Ethereum address involved in the swaps held 644.5 ETH as of 17:25 UTC on September 3. The total value of the stolen Bitcoin routed through THORChain was 20.69 BTC, with the majority consolidated into a single Ethereum wallet. Meanwhile, over 1,400 BTC linked to the Coldcard theft remains traceable but unmoved, highlighting the scale of unrecovered funds still at risk.

Cross-chain protocols like THORChain are designed to facilitate decentralized asset swaps between blockchains without relying on centralized intermediaries. While these tools expand user flexibility and liquidity, they also introduce new vectors for laundering stolen assets. Once funds are swapped across chains, especially through protocols that do not require identity verification, the practical ability of law enforcement or victims to recover assets drops sharply. This trade-off between interoperability and security is now a central challenge for both users and regulators navigating the evolving crypto landscape.