About 20.5 BTC linked to the Coldcard theft was reportedly moved through THORChain and into Ethereum, a cross-chain hop that shifts stolen bitcoin out of its original network and complicates efforts to follow the money.
The movement was flagged by on-chain watchers tracking wallets tied to the theft. According to a post from on-chain researcher intangiblecoins on X, funds connected to the incident were routed toward Ethereum rather than left sitting on Bitcoin. For related coverage, see Bitcoin ETFs Rebound as Ethereum and XRP ETF Winning Streaks End.
What reportedly moved
The amount in question is roughly 20.5 BTC, and it is described as linked to the Coldcard theft rather than confirmed by any legal ruling. That distinction matters: “linked” reflects blockchain tracing, not a court finding. For related coverage, see ASIC crypto deadline: Sept. 30 for Australian firms.
The affected addresses are viewable on public explorers, including a Bitcoin address tracked on Mempool.space. A separate community-maintained timeline of the Coldcard incident has been documenting the flow of funds as they move.
The broader incident has already prompted warnings from the hardware wallet maker. Coldcard urged Mk3 users to move their funds during the drain investigation, and later released firmware 5.6.1 while telling affected users to move their bitcoin.
Why the THORChain-to-Ethereum route stands out
THORChain is a decentralized protocol that lets people swap one cryptocurrency for another across different blockchains without a central exchange. Using it, someone can turn native bitcoin into an asset that lives on Ethereum.
That is the analytical detail here. The funds did not just move between Bitcoin wallets; they crossed from the Bitcoin network into the Ethereum ecosystem.
Cross-chain hops like this can make monitoring harder. When value jumps networks, investigators have to pick up the trail on a second blockchain instead of following a single chain of Bitcoin transactions.
What this means for people holding crypto
For everyday holders, the takeaway is simple. Stolen funds rarely sit still, and moving them across chains is a common way to muddy the trail for anyone trying to trace or recover them.
It also keeps attention on hardware wallet security. The Coldcard case sits alongside other law-enforcement-driven crypto stories, such as when the FBI seized Hamas crypto fundraising infrastructure, where tracing on-chain movement was central to the response.
If you use a hardware wallet, keep its firmware current and follow the maker’s official guidance. Watching where funds go, using public block explorers, remains one of the few tools available to the public after a theft.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
