Coldcard Bitcoin Theft Transferred to Ethereum Through 34 Exchanges

Bitcoin associated with the 2026 Coldcard hardware wallet theft began transferring to the Ethereum network this week. According to Bitquery data, 20.49703196 BTC was moved from an address controlled by the attacker on September 2, linked to Wave 3. The funds were emptied after passing through two new Bitcoin addresses and exchanged via THORChain. The tracker recorded 34 exchanges on September 2 and 3, transferring 20.45 BTC to Ethereum, marking a shift from a dormant state to an active cross-chain trajectory. The majority of the amount, 20.15 BTC, was transferred in 26 exchanges to a primary address on Ethereum, while another 0.30 BTC was transferred in 8 exchanges to a second address, with two earlier exchanges (on August 2) totaling 0.24 BTC pointing to a third destination. Bitquery statistics show that at Bitcoin block 965,339, 1.40259 BTC remains in identified and traceable addresses, of which 1.39633 BTC has never moved, and 20.69 BTC was sent to Ethereum via THORChain. As of September 3, 16:15 UTC, the primary address on the Ethereum network held 649.5 ETH, with no outflows. By 17:25 UTC, the balance showed 644.4974 ETH, a decrease of about 5 ETH. Bitquery categorized the source address as "reported," with the identity of the controller still undetermined, and the connections between the outflows remain unresolved.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.