Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum
Bitcoin flagged by blockchain information supplier Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash started moving. The route shifted the case from a largely parked stash to an energetic cross-chain path.
The Sept. 2 exercise started when 20.49703196 BTC left an deal with that Bitquery’s classification file lists as “reported,” attacker-controlled and tied to Wave 3. The funds handed by way of two recent Bitcoin addresses, each later emptied, in accordance to the tracker’s movement data.
Bitquery locations the origin in its reported tier, beneath its confirmed addresses. The controller stays unidentified, and hyperlinks between the broader drain waves stay unresolved.
THORChain is a cross-chain swap protocol. The live tracker recorded 34 swaps on Sept. 2–3 that routed 20.45 BTC of traced worth into Ethereum. Its broader complete was 20.69 BTC throughout 36 swaps as a result of it additionally included two earlier swaps totaling 0.24 BTC on Aug. 2.
Most of the entire, 20.15 BTC throughout 26 swaps, was routed towards 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC went by way of eight swaps to a second Ethereum deal with, whereas the 2 August swaps named a 3rd.
Bitquery’s dated desk exhibits THORChain protocol memos naming the principal vacation spot for consultant Sept. 2 and Sept. 3 Bitcoin transactions.
The principal Ethereum deal with held a rounded 649.5 ETH and had despatched no outgoing transactions at Bitquery’s 16:15 UTC verify on Sept. 3. By 17:25 UTC, a Blockscout balance response confirmed 644.4974 ETH.
The roughly 5 ETH decline marked a change after the sooner snapshot.
Most recognized Bitcoin stays parked
At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC nonetheless sitting in recognized addresses and absolutely traceable, together with 1,396.33 BTC that had by no means moved. The tracker categorized the 20.69 BTC routed by way of THORChain individually as watched on Ethereum.
An independent Bitcoin-block-derived dataset reviews Waves 1-3 individually from a 64.90373764 BTC Wave 4 and says the chain can’t decide whether or not the identical operator was accountable. Galaxy Research has likewise stated it cannot definitively link the entire wave footprints.
The Sept. 2-3 swaps flip a largely parked-funds case into an energetic cross-chain hint, with the principal Ethereum deal with nonetheless holding about 644.5 ETH on the newest verify.
The publish Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum appeared first on CryptoSlate.
