Bitcoin flagged by blockchain data provider Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash began moving. The route shifted the case from a largely parked stash to an active cross-chain trail.
The Sept. 2 activity began when 20.49703196 BTC left an address that Bitquery's classification file lists as “reported,” attacker-controlled and tied to Wave 3. The funds passed through two fresh Bitcoin addresses, both later emptied, according to the tracker's movement data.
Bitquery places the origin in its reported tier, below its confirmed addresses. The controller remains unidentified, and links between the wider drain waves remain unresolved.
THORChain is a cross-chain swap protocol. The live tracker recorded 34 swaps on Sept. 2–3 that routed 20.45 BTC of traced value into Ethereum. Its broader total was 20.69 BTC across 36 swaps because it also included two earlier swaps totaling 0.24 BTC on Aug. 2.
Most of the total, 20.15 BTC across 26 swaps, was routed toward 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC went through eight swaps to a second Ethereum address, while the two August swaps named a third.
Bitquery's dated table shows THORChain protocol memos naming the principal destination for representative Sept. 2 and Sept. 3 Bitcoin transactions.
The principal Ethereum address held a rounded 649.5 ETH and had sent no outgoing transactions at Bitquery's 16:15 UTC check on Sept. 3. By 17:25 UTC, a Blockscout balance response showed 644.4974 ETH.
The roughly 5 ETH decline marked a change after the earlier snapshot.
Most identified Bitcoin remains parked
At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC still sitting in identified addresses and fully traceable, including 1,396.33 BTC that had never moved. The tracker classified the 20.69 BTC routed through THORChain separately as watched on Ethereum.
An independent Bitcoin-block-derived dataset reports Waves 1-3 separately from a 64.90373764 BTC Wave 4 and says the chain cannot determine whether the same operator was responsible. Galaxy Research has likewise said it cannot definitively link all of the wave footprints.
The Sept. 2-3 swaps turn a largely parked-funds case into an active cross-chain trace, with the principal Ethereum address still holding about 644.5 ETH at the latest check.
The post Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum appeared first on CryptoSlate.