CryptoSlate
A thief tied to the Coldcard hardware-wallet theft moved 20.497 BTC on September 2, routing the funds through two intermediate Bitcoin addresses and 34 cross-chain swaps on THORChain into Ethereum. The activity, flagged by blockchain tracker Bitquery, shifts a case that had been dominated by dormant wallets into an active cross-chain trace. A single Ethereum address (0x160a7A4c067B084F03400c6980Ac29F73F6782f6) absorbed 20.15 BTC across 26 of the swaps, while a second address received another 0.30 BTC across eight swaps. The principal wallet held roughly 644.5 ETH at the latest Blockscout check, down about 5 ETH from an earlier snapshot.
Why it matters
The movement reverses months of forensic inactivity. Since the original Coldcard theft, investigators had been cataloging largely static Bitcoin balances, with 1,402.59 BTC still identified at block 965,339 and 1,396.33 BTC never moved. Galaxy Research has said it cannot definitively link all the wave footprints, leaving attribution fragmented across the separate drain waves. With THORChain now in the loop, the attacker has demonstrated a working cross-chain laundering pipeline even as researchers remain unable to name a controller. Bitquery still classifies the origin address as "reported" rather than confirmed, meaning the link to the Coldcard heist itself is asserted, not chain-proven.
Market impact
THORChain's role will draw fresh attention to a protocol already under scrutiny after its recent emergency chain halt. The traced flows do not move BTC or ETH spot prices directly, but they tighten the lens on cross-chain swap venues as off-ramps for hardware-wallet theft proceeds. The roughly 644 ETH now sitting at the principal destination leaves investigators with a fresh batch of addresses to watch, while 1,402 BTC of identified but unmoved loot keeps the parked-funds case running in parallel.
Frequently asked questions
-
How much Bitcoin was moved from the Coldcard theft on Sept. 2?
20.497 BTC left a Wave 3 address flagged by Bitquery as attacker-controlled and was routed through two intermediate Bitcoin addresses, both later emptied.
-
How did the funds cross from Bitcoin into Ethereum?
The attacker used 34 THORChain swaps on Sept. 2 and 3, with 20.15 BTC across 26 of those swaps landing at a single Ethereum address.
-
Is the link between these funds and the Coldcard theft confirmed on-chain?
No. Bitquery classifies the origin address in its "reported" tier, below its confirmed addresses, and Galaxy Research has said it cannot definitively link all wave footprints.
-
How much of the identified stolen Bitcoin is still parked?
1,402.59 BTC remained in identified addresses at Bitcoin block 965,339, including 1,396.33 BTC that had never moved.
-
Why is the THORChain routing significant?
It demonstrates the attacker has a working cross-chain laundering pipeline and turns a dormant forensic accounting case into an active live trace.
CoinTelegraph
TheBlock
CoinDesk
WuBlockchain
Crypto Rank News
Lookonchain