Bitcoin flagged by blockchain information supplier Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash started transferring. The route shifted the case from a largely parked stash to an energetic cross-chain path.
The Sept. 2 exercise started when 20.49703196 BTC left an deal with that Bitquery's classification file lists as “reported,” attacker-controlled and tied to Wave 3. The funds handed by two recent Bitcoin addresses, each later emptied, in accordance with the tracker's motion information.
Bitquery locations the origin in its reported tier, under its confirmed addresses. The controller stays unidentified, and hyperlinks between the broader drain waves stay unresolved.
THORChain is a cross-chain swap protocol. The reside tracker recorded 34 swaps on Sept. 2–3 that routed 20.45 BTC of traced worth into Ethereum. Its broader complete was 20.69 BTC throughout 36 swaps as a result of it additionally included two earlier swaps totaling 0.24 BTC on Aug. 2.
THORChain exploit turns emergency chain halt into a DeFi trust test
Many of the complete, 20.15 BTC throughout 26 swaps, was routed towards 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. One other 0.30 BTC went by eight swaps to a second Ethereum deal with, whereas the 2 August swaps named a 3rd.
Bitquery's dated desk exhibits THORChain protocol memos naming the principal vacation spot for consultant Sept. 2 and Sept. 3 Bitcoin transactions.
The principal Ethereum deal with held a rounded 649.5 ETH and had despatched no outgoing transactions at Bitquery's 16:15 UTC test on Sept. 3. By 17:25 UTC, a Blockscout steadiness response confirmed 644.4974 ETH.
The roughly 5 ETH decline marked a change after the sooner snapshot.
Most recognized Bitcoin stays parked
At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC nonetheless sitting in recognized addresses and totally traceable, together with 1,396.33 BTC that had by no means moved. The tracker categorised the 20.69 BTC routed by THORChain individually as watched on Ethereum.
An impartial Bitcoin-block-derived dataset reviews Waves 1-3 individually from a 64.90373764 BTC Wave 4 and says the chain can not decide whether or not the identical operator was accountable. Galaxy Analysis has likewise mentioned it can not definitively hyperlink all the wave footprints.
The Sept. 2-3 swaps flip a largely parked-funds case into an energetic cross-chain hint, with the principal Ethereum deal with nonetheless holding about 644.5 ETH on the newest test.
The submit Parked Coldcard loot begins transferring as attacker routes $1.6M in stolen Bitcoin to Ethereum appeared first on CryptoSlate.