Coldcard Theft Funds Move: 20.45 BTC Routed to Ethereum

Blockchain analytics firm Bitquery traced 20.49703196 BTC linked to the 2026 Coldcard hardware‑wallet theft through a series of swaps that converted the funds into Ethereum on Sept. 2–3. The tracked transfers used 34 THORChain swaps and moved roughly $1.6 million in bitcoin.

The traced coins left an address Bitquery classifies as “reported” and tied to Wave 3. The funds passed through two new Bitcoin addresses that were later emptied before entering THORChain. Bitquery’s broader tally includes two earlier THORChain swaps on Aug. 2 totaling 0.24 BTC, bringing the total routed via THORChain to about 20.69 BTC across 36 swaps.

Most of the routed value — 20.15 BTC sent in 26 swaps — arrived at an Ethereum address identified in tracker data as 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC moved through eight swaps to a second Ethereum address, and the two August swaps were tied to a third destination. THORChain transaction memos for representative swaps on Sept. 2 and Sept. 3 named the principal Ethereum destination.

At 16:15 UTC on Sept. 3, Bitquery’s snapshot showed the principal Ethereum address holding roughly 649.5 ETH with no outgoing transactions. A later balance check at 17:25 UTC on the same day via Blockscout showed 644.4974 ETH, indicating about 5 ETH left that address between those checks.

Most identified bitcoin connected to the case remains on Bitcoin. At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC still sitting in addresses it flagged, including 1,396.33 BTC that had not moved. Independent chain‑derived datasets separate Waves 1–3 from a larger Wave 4 of 64.90373764 BTC and note that chain data alone cannot determine whether the same operator controlled all waves. Galaxy Research likewise does not definitively link all wave footprints to a single actor.

Bitquery places the origin address in a “reported” tier below its confirmed addresses, and the wallet controller remains unidentified. The Sept. 2–3 swaps created a traceable cross‑chain trail for a portion of the stolen funds while most of the identified bitcoin remains stationary on the Bitcoin blockchain.

THORChain is a decentralized cross‑chain swap protocol that enables direct swaps between blockchains without a central intermediary; here it was used to convert traced bitcoin into Ethereum. The tracked swaps were structured across multiple smaller transactions and addresses, and the principal Ethereum destination held several hundred ETH after the conversions.

No law enforcement statements appear in the available tracking data, and the analytics records do not identify the wallet controller or link all theft waves to a single operator.