{"id":12792,"date":"2026-09-04T02:05:22","date_gmt":"2026-09-04T02:05:22","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12792"},"modified":"2026-09-04T02:05:22","modified_gmt":"2026-09-04T02:05:22","slug":"parked-coldcard-loot-begins-moving-as-attacker-routes-1-6m-in-stolen-bitcoin-to-ethereum","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12792","title":{"rendered":"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum"},"content":{"rendered":"<p><\/p>\n<div data-single-article-content=\"\">\n<p>Bitcoin flagged by blockchain data provider Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash began moving. The route shifted the case from a largely parked stash to an active cross-chain trail.<\/p>\n<p>The Sept. 2 activity began when 20.49703196 BTC left an address that Bitquery&#8217;s classification file lists as \u201creported,\u201d attacker-controlled and tied to Wave 3. The funds passed through two fresh Bitcoin addresses, both later emptied, according to the tracker&#8217;s movement data.<\/p>\n<p>Bitquery places the origin in its reported tier, below its confirmed addresses. The controller remains unidentified, and links between the wider drain waves remain unresolved.<\/p>\n<p>THORChain is a cross-chain swap protocol. The live tracker recorded 34 swaps on Sept. 2\u20133 that routed 20.45 BTC of traced value into Ethereum. Its broader total was 20.69 BTC across 36 swaps because it also included two earlier swaps totaling 0.24 BTC on Aug. 2.<\/p>\n<div class=\"cs-article-embed\">\n<p> <span class=\"cs-article-embed__related-reading\">Related Reading<\/span><\/p>\n<h3 class=\"cs-article-embed__title\">THORChain exploit turns emergency chain halt into a DeFi trust test<\/h3>\n<\/p>\n<p> <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\"> <i class=\"fa-light fa-arrow-up-right\"\/> <\/span> <\/div>\n<p>Most of the total, 20.15 BTC across 26 swaps, was routed toward 0x160a7A4c067B084F03400c6980Ac29F73F6782f6. Another 0.30 BTC went through eight swaps to a second Ethereum address, while the two August swaps named a third.<\/p>\n<p>Bitquery&#8217;s dated table shows THORChain protocol memos naming the principal destination for representative Sept. 2 and Sept. 3 Bitcoin transactions.<\/p>\n<aside id=\"cs-inline-newsletter-1\" class=\"cs-inline-newsletter\" data-inline-newsletter=\"\" data-newsletter-placement=\"article-midpoint\" data-newsletter-pending-label=\"Joining\u2026\" data-newsletter-pending-status=\"Joining the Daily Brief\u2026\" data-newsletter-email-required-message=\"Before sending, please provide your email address.\" aria-labelledby=\"cs-inline-newsletter-1-title\" aria-describedby=\"cs-inline-newsletter-1-copy\">\n<div class=\"cs-inline-newsletter__inner\">\n<div class=\"cs-inline-newsletter__content\"> <span class=\"cs-inline-newsletter__eyebrow\"> <i class=\"fa-regular fa-envelope\" aria-hidden=\"true\"\/> The Daily Brief <\/span><\/p>\n<h2 id=\"cs-inline-newsletter-1-title\" class=\"cs-inline-newsletter__title\">The signal, before the noise.<\/h2>\n<p id=\"cs-inline-newsletter-1-copy\" class=\"cs-inline-newsletter__copy\">Start your day with the crypto stories moving markets, decoded by CryptoSlate\u2019s editors.<\/p>\n<\/div>\n<div class=\"cs-inline-newsletter__form-shell\">\n<p class=\"cs-inline-newsletter__form-heading\">One email. Everything that matters.<\/p>\n<p id=\"cs-inline-newsletter-1-privacy\" class=\"cs-inline-newsletter__privacy\">Free to join. Unsubscribe any time.<\/p>\n<p> <i class=\"fa-regular fa-circle-xmark\" aria-hidden=\"true\"\/> <span>Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n<p> <i class=\"fa-regular fa-circle-check\" aria-hidden=\"true\"\/> <span><strong>You\u2019re on the list.<\/strong> Your next Daily Brief is on its way.<\/span><\/p>\n<\/div>\n<\/div>\n<\/aside>\n<figure id=\"attachment_560260\" aria-describedby=\"caption-attachment-560260\" style=\"width: 720px\" class=\"wp-caption aligncenter\"><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-560260\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec.png\" alt=\"Flow diagram showing 20.497 BTC moving through two Bitcoin addresses and 34 THORChain swaps to Ethereum, with destination amounts and tracked balances.\" width=\"720\" height=\"1514\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec.png 865w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-143x300.png 143w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-487x1024.png 487w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-768x1615.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-730x1536.png 730w\" sizes=\"(max-width: 720px) 100vw, 720px\"\/><img decoding=\"async\" class=\"lazyload wp-image-560260\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec.png\" alt=\"Flow diagram showing 20.497 BTC moving through two Bitcoin addresses and 34 THORChain swaps to Ethereum, with destination amounts and tracked balances.\" width=\"720\" height=\"1514\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec.png 865w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-143x300.png 143w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-487x1024.png 487w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-768x1615.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-84481198-7b1b-45f2-b00c-20922f3428ec-730x1536.png 730w\" data-sizes=\"(max-width: 720px) 100vw, 720px\"\/><figcaption id=\"caption-attachment-560260\" class=\"wp-caption-text\">Diagram traces 20.497 BTC through two addresses, 34 THORChain swaps, and Ethereum-linked wallets, with 1,402.59 BTC still unidentified.<\/figcaption><\/figure>\n<p>The principal Ethereum address held a rounded 649.5 ETH and had sent no outgoing transactions at Bitquery&#8217;s 16:15 UTC check on Sept. 3. By 17:25 UTC, a Blockscout balance response showed 644.4974 ETH.<\/p>\n<p>The roughly 5 ETH decline marked a change after the earlier snapshot.<\/p>\n<h2>Most identified Bitcoin remains parked<\/h2>\n<p>At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC still sitting in identified addresses and fully traceable, including 1,396.33 BTC that had never moved. The tracker classified the 20.69 BTC routed through THORChain separately as watched on Ethereum.<\/p>\n<p>An independent Bitcoin-block-derived dataset reports Waves 1-3 separately from a 64.90373764 BTC Wave 4 and says the chain cannot determine whether the same operator was responsible. Galaxy Research has likewise said it cannot definitively link all of the wave footprints.<\/p>\n<p>The Sept. 2-3 swaps turn a largely parked-funds case into an active cross-chain trace, with the principal Ethereum address still holding about 644.5 ETH at the latest check.<\/p>\n<\/div>\n<p>Analysis,Featured,Hacks,Wallets,Bitcoin,BTC,Coldcard,ethereum,ThorchainBitcoin,BTC,Coldcard,ethereum,Thorchain#Parked #Coldcard #loot #begins #moving #attacker #routes #1.6M #stolen #Bitcoin #Ethereum1788487522<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitcoin flagged by blockchain data provider Bitquery as linked to the 2026 Coldcard hardware-wallet theft crossed into Ethereum this week after a tracked 20.5 BTC stash began moving. The route shifted the case from a largely parked stash to an active cross-chain trail. The Sept. 2 activity began when 20.49703196 BTC left an address that<\/p>\n","protected":false},"author":1,"featured_media":12793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[6723,6422,1039,91,285,5845,31,6722,249,6721,5158,2671,4515],"class_list":["post-12792","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-1-6m","tag-attacker","tag-begins","tag-bitcoin","tag-btc","tag-coldcard","tag-ethereum","tag-loot","tag-moving","tag-parked","tag-routes","tag-stolen","tag-thorchain"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=12792\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum\" \/>\n<meta property=\"og:description\" content=\"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=12792\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-04T02:05:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=12792\",\"name\":\"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg\",\"datePublished\":\"2026-09-04T02:05:22+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=12792\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=12792#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum - Crypto News: Latest Cryptocurrency News and Analysis","description":"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=12792","og_locale":"en_US","og_type":"article","og_title":"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum","og_description":"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.","og_url":"https:\/\/cryptonews.uk.com\/?p=12792","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-09-04T02:05:22+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=12792","url":"https:\/\/cryptonews.uk.com\/?p=12792","name":"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg","datePublished":"2026-09-04T02:05:22+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"Bitquery traced 20.45 BTC through 34 Bitcoin swaps, and the main destination later held roughly 5 ETH less.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=12792#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=12792"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=12792#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/09\/coldcard-bitcoin-ethereum-cross-chain.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=12792#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Parked Coldcard loot begins moving as attacker routes $1.6M in stolen Bitcoin to Ethereum"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12792"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/12792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/12793"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}