Stolen Bitcoin Shifts from Parking Lot to Active Trail

A stash of $1.6 million in stolen Bitcoin has begun moving after being parked for some time. According to blockchain data provider Bitquery, a tracked 20.5 BTC stash linked to the 2026 Coldcard hardware-wallet theft started shifting on September 2. The funds left an address labeled 'reported' by Bitquery and controlled by an attacker.

The route from Bitcoin to Ethereum was facilitated through THORChain, a cross-chain swap protocol. On September 2-3, there were 34 swaps that routed 20.45 BTC of traced value into Ethereum. The majority of this total, 20.15 BTC across 26 swaps, went towards a single Ethereum address.

Bitquery's data shows that THORChain memos named the principal destination for representative September 2 and 3 Bitcoin transactions. However, the controller behind the stolen funds remains unidentified.