Coldcard thief moves 20.5 BTC after months parked. The ETH trail changes everything.

What do you do with 1,400 BTC you can't spend? That's the question hanging over the Coldcard hack, one of the largest hardware wallet exploits in recent memory. And this week we got a partial answer: you start moving it.

On Sept. 2, a 20.49703196 BTC tranche left an address that blockchain data provider Bitquery classifies as attacker-controlled. The funds moved through two fresh Bitcoin addresses, both of which were emptied shortly after. Then they crossed into Ethereum. That's not just a transaction. That's the case changing shape.

The raw numbers

Bitquery's live tracker recorded 34 THORChain swaps on Sept. 2-3 that routed 20.45 BTC of traced value into Ethereum. The broader picture includes 36 swaps totaling 20.69 BTC, but two of those happened back on Aug. 2 and only accounted for 0.24 BTC. The real action was this week.

Most of it, 20.15 BTC across 26 swaps, landed at one principal Ethereum address: 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC went to a second address through eight swaps. The two August swaps named a third destination.

That principal wallet isn't idle. At 16:15 UTC on Sept. 3, it held a rounded 649.5 ETH. By 17:25 UTC, Blockscout showed 644.4974 ETH. Roughly 5 ETH had moved in a little over an hour. At current prices that's a small test run, but it proves the operator is actively managing the funds.

Here's the thing about the rest of the loot: it's still parked. Bitquery counts 1,402.59 BTC sitting in identified addresses at Bitcoin block 965,339. That includes 1,396.33 BTC that has never moved since the initial theft. So this 20.5 BTC shuffle is less about the dollar amount and more about intent.

Why this move matters

Slapping a token on a GPU rental isn't a convergence thesis. But moving stolen Bitcoin through THORChain? That's a convergence too, and it's the kind no one celebrates. THORChain is a cross-chain swap protocol built for exactly this kind of liquidity movement. It doesn't ask permission. It doesn't care about your sanctions list. It just routes value.

The route tells us something. This thief sat on the Bitcoin for months. Why? Because Bitcoin is hard to launder at scale without getting flagged. Chain analysis firms have mapped the major exchanges. Privacy tools on BTC are slower and clunkier. But Ethereum has a whole different set of rails: DeFi protocols, bridges, mixing services, and a deeper off-ramp infrastructure.

So the move to ETH is likely a precursor to either a mixing strategy or a fiat off-ramp. It could also be a test to see if the trackers catch it. They did. But the question now is whether the trail holds once funds are wrapped and swapped again.

And there's a bigger problem. This entire case is built on probabilistic classification. Bitquery places this 20.5 BTC in its "reported" tier, which is below its "confirmed" addresses. The controller isn't identified. Independent datasets separate Waves 1-3 from a 64.90373764 BTC Wave 4, and even Galaxy Research says it can't definitively link all the wave footprints. So who actually did this? The chain says maybe one operator. Maybe more.

Traders and analysts are watching

“Watch the receiving address,” is the quiet consensus among the crypto forensics crowd I've been talking to. If the thief starts peeling off ETH to tornado-style mixers or privacy wallets, expect the trace to go cold fast. If they send funds to a centralized exchange with KYC, the case might actually resolve.

But most experienced analysts aren't holding their breath. They've seen this pattern. The thief doesn't have to outrun the chain analysts forever. They just have to find one sloppy exchange or one permissive bridge. And with decentralized rails like THORChain in the middle, attribution gets murky by design.

There's a second angle that doesn't get enough attention: THORChain's own history. This is a protocol that suffered an exploit in 2024, which triggered an emergency chain halt and sparked a serious trust debate among its community. Now it's the highway of choice for moving stolen Coldcard funds. That's not a bug. That's neutral infrastructure. But it's worth asking whether DeFi can keep claiming neutrality when the biggest users are thieves under active investigation.

Word to the wise: if you're building on these rails, your "attestation" layer matters. And nobody's built one that can freeze a cross-chain swap in real time.

What's next

First, the 644.5 ETH sitting at 0x160a. If that balance starts moving in larger chunks, expect a corresponding spike in mixer deposits or exchange transfers. The 5 ETH drop on Sept. 3 was likely a fee test or a gas-funding transaction.

Second, watch the secondary addresses. The 0.30 BTC split across eight swaps could become a habit. Thieves often parcel out small amounts to avoid tipping off centralized compliance teams. Each parcel erodes the traceability.

Third, and this is the big one, watch the 1,396.33 BTC that hasn't moved. If this THORChain route works cleanly, the operator now knows they can shift the coins. A full liquidation at current prices would be devastating to order books across multiple venues. Don't expect it all at once. But do expect incremental moves if this test succeeds.

The timeline matters too. The original Coldcard breach traces back to 2026. This is a patient attacker. They've watched the tracking tools mature. They've seen other thefts get frozen. And now they're moving with a method that suggests professional help.

So who wins here? If the thief reaches a mixer before analysts get an exchange to freeze funds, the case goes cold. If Bitquery's classification holds and the Ethereum trail remains visible, the funds stay marked and effectively unspendable in the legitimate economy. That's the real battle: not catching the thief, but making the loot radioactive.

It usually works, by the way. Most of the 1,400 BTC is still untouched because the thief knows every satoshi is flagged. But 20.5 BTC just crossed the line. And the only thing standing between this case and a dead end is a handful of block explorers and one ETH address that's already started spending.

The next move will tell us everything. Refresh the tracker tomorrow morning.