Crypto
Coldcard Loot Moves Through 34 THORChain Swaps into Ethereum
A significant movement of funds linked to the 2026 Coldcard theft has been detected, as 20.5 BTC was routed through 34 THORChain swaps into Ethereum on September 2-3.
The transfers shifted the investigation from a largely parked stash to an active cross-chain trail, with about 5 ETH leaving the main destination.
According to blockchain data provider Bitquery, the funds passed through two fresh Bitcoin addresses before entering the THORChain protocol.
The principal Ethereum address held a rounded 649.5 ETH and had sent no outgoing transactions at Bitquery's 16:15 UTC check on September 3.
Most identified Bitcoin remains parked, but links among the wider theft waves and their operator remain unresolved.