A significant amount of Bitcoin linked to the 2026 Coldcard hardware wallet theft has surfaced after being dormant, as blockchain analytics provider Bitquery tracked the movement of 20.5 BTC through THORChain into Ethereum. This marks a notable development in the ongoing investigation into the high-profile crypto theft.
Coldcard theft funds make active cross-chain move
The transfer began on September 2, when 20.49703196 BTC left a previously identified address associated with what Bitquery describes as “Wave 3” of the Coldcard incident. After passing through two fresh intermediary Bitcoin addresses—both emptied during the process—the funds started a complex journey involving cross-chain swaps.
Bitquery classified the source address as “reported,” indicating it is tied to the known case but falls short of their most-verified category. The identities of those controlling the funds remain unknown, leaving investigators without clear suspects.
The activity shifted the investigation from long-inactive stolen Bitcoin to an active cross-chain trail, as Bitquery tracked the coins moving from Bitcoin to Ethereum networks for the first time since the theft occurred.
Researchers have stated that, until this movement, most of the stolen Bitcoin had remained untouched for an extended period, further obscuring the origins and intentions of the individuals involved.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLTraced Bitcoin funneled through THORChain swaps
THORChain, a decentralized cross-chain protocol enabling the swap of crypto assets between various blockchain networks, processed a series of 34 swaps on September 2 and 3. These operations transferred 20.45 BTC into the Ethereum network.
Bitquery’s full tracking registers a total of 20.69 BTC swapped across 36 operations, including two earlier swaps on August 2 worth 0.24 BTC in total. The bulk of the assets—20.15 BTC—found their way to a single Ethereum address via 26 swaps, while another 0.3 BTC ended up at a second address through eight additional swaps. Two further swaps from August directed funds to a third Ethereum address.
Records show THORChain swap memos specified the primary destination address for the September flows. When checked at 16:15 UTC on September 3, the main recipient Ethereum address contained approximately 649.5 ETH and had not shown any outgoing transactions. By 17:25 UTC, new activity reduced the balance by around 5 ETH, marking the first outbound transaction since receiving the funds.
Mini dictionary: THORChain is a decentralized liquidity protocol that allows users to swap assets across different blockchains without relying on centralized exchanges, providing cross-chain interoperability.
| Swap Date | Total BTC Swapped | Number of Swaps | Main Ethereum Address ETH Change |
|---|---|---|---|
| September 2-3 | 20.45 BTC | 34 | 649.5 ETH to 644.5 ETH |
| August 2 | 0.24 BTC | 2 | Separate address |
Majority of stolen Bitcoin remains untouched
Despite the recent activity, most of the Bitcoin stolen in the Coldcard breach remains unmoved. At block 965,339, investigators reported that 1,402.59 BTC were still sitting in addresses identified as connected to the theft. Of these, 1,396.33 BTC had never left their original theft addresses, reinforcing the opacity around the ultimate disposition of the majority of stolen assets.
Blockchain datasets partition the Coldcard heist into several “waves” by block data. Waves 1 through 3 are tracked separately from a fourth wave involving 64.90373764 BTC. Bitquery and researchers at Galaxy Research caution that blockchain evidence alone cannot determine whether the thefts share a single perpetrator or group.
Galaxy Research, a digital asset and blockchain analytics firm, estimates the total loss from the Coldcard hardware wallet theft at over 1,700 BTC. The status of the main Ethereum address tied to September’s swaps remains under surveillance, with a balance of about 644.5 ETH, while the vast majority of the stolen Bitcoin remains classified as dormant.
Researchers including Galaxy Research maintain they cannot confirm whether individual or collective responsibility lies behind every wave of the Coldcard wallet theft, underscoring continued uncertainty for investigators.
