Coldcard Heist Stashes Move to Ethereum via THORChain Swaps
A stash of Bitcoin stolen from Coldcard hardware wallets in 2026 is making moves. Data provider Bitquery tracked funds moving through 34 THORChain swaps into Ethereum on September 2 and 3.
The funds, linked to what Bitquery calls Wave 3 of the theft, started with a transfer of 20.49703196 BTC from an address tied to the reported attacker. This address is classified as 'reported' by Bitquery, one step below its confirmed list.
Most of the traced value, 20.15 BTC across 26 swaps, landed at one Ethereum address. A smaller amount, 0.30 BTC, moved through eight swaps to a second address. The two August swaps sent funds to a third address.
The main Ethereum address held about 649.5 ETH with no outgoing transactions when checked at 16:15 UTC on September 3. About an hour later, at 17:25 UTC, a balance check showed 644.4974 ETH. This marked the first outgoing activity from that address since the funds arrived.