Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum

According to CryptoSlate, a stash of Bitcoin linked to the 2026 Coldcard hardware-wallet theft began moving into Ethereum between September 2 and September 3. Blockchain data provider Bitquery tracked 20.45 BTC moving through 34 THORChain swaps, shifting the investigation from a parked stash to an active cross-chain trail. The activity began when 20.497 BTC left an attacker-controlled address tied to Wave 3. Most of the value, totaling 20.15 BTC across 26 swaps, was routed toward a primary Ethereum address, which later held roughly 644.5 ETH after a decline of about 5 ETH.

Bitquery noted that the controller remains unidentified, and links between the wider theft waves remain unresolved. An independent dataset reports Waves 1 through 3 separately from a Wave 4, while Galaxy Research has stated it cannot definitively link all wave footprints together. Meanwhile, Bitquery counted 1,402.59 BTC still sitting in identified addresses, including 1,396.33 BTC that had never moved.