Over $1.6 million in stolen Bitcoin shifts to Ethereum as tracked swaps reveal a new active movement.
In a notable development within the cryptocurrency ecosystem, a significant amount of stolen Bitcoin has begun moving after remaining dormant for an extended period. As traced by the blockchain data provider Bitquery, around 20.45 BTC was transferred through a series of swaps and eventually routed to the Ethereum network. This activity involves a theft linked to the Coldcard vulnerability-leading-to-massive-zil-theft/">hardware wallet, specifically an incident that occurred in 2026.
Initially, the stolen Bitcoin was mostly parked, raising questions about its potential use or return. However, on September 2, a movement involving this cryptocurrency started when 20.49703196 BTC was transferred from an address classified by Bitquery as “reported” and under the control of the attacker. The movement raised alarms and brought renewed scrutiny to the origins and paths of these funds.
According to data from Bitquery, the funds were moved through two new Bitcoin addresses, both of which were emptied soon after the transactions were completed. This behavior suggests that the attacker is actively trying to distance themselves from the original theft, further complicating tracing efforts.
The tracked movement saw 34 swaps taking place over September 2 and 3, culminating in a total of 20.69 BTC entering the Ethereum ecosystem. These transactions included two earlier swaps from August valued at 0.24 BTC. The main destination for the majority of these transfers culminated at an Ethereum address identified as 0x160a7A4c067B084F03400c6980Ac29F73F6782f6, which received around 20.15 BTC across 26 individual swaps.
Additionally, another 0.30 BTC was directed through eight swaps to a different Ethereum address, showcasing the elaborate method employed by the attacker to obscure the trail of stolen funds. The Ethereum address that received the bulk of the funds was reported to hold approximately 649.5 ETH at the time of the last check by Bitquery.
At the time Bitquery conducted its final balance check on September 3, the Ethereum address had seen its holdings decrease to about 644.4974 ETH. This slight decline in value may indicate early attempts at liquidating portions of the newly acquired cryptocurrency as part of a money laundering strategy.
In terms of Bitcoin reserves, as of block 965,339, there remained an astonishing 1,402.59 BTC across identified addresses. Among these, 1,396.33 BTC has consistently remained unmoved, hinting at the original stash's potential classification as unspent, or simply the result of cautious management of the stolen assets’ remaining amounts. Bitquery further classified the recently transferred 20.69 BTC as observed within the Ethereum network separately from other holdings.
The recent activity involving the movement of these stolen funds illustrates the dynamic and often perilous nature of the cryptocurrency market. The fact that significant amounts of Bitcoin associated with theft can be swapped and potentially laundered through platforms like THORChain raises alarms among security professionals and investors alike.
As organizations continue to develop strategies to mitigate the risks associated with blockchain technology and assets, this incident serves as a reminder of the necessity for robust security measures. The movements of the funds signify that these stolen assets are not only moving but putting pressure on exchanges and decentralized finance (DeFi) protocols that facilitate such transactions.
With Bitcoin currently reflecting a healthy performance at a +5.47% increase in the last 24 hours, as per market reports, the continuous monitoring of these movements can help authorities and crypto exchanges better combat theft and fraud within the ecosystem.
The journey ahead for Bitcoin and Ethereum amid evolving scenarios involving theft and illicit transfers is one fraught with both challenges and opportunities. While law enforcement and blockchain analysis have advanced considerably, the ongoing adaptations by those attempting to conceal the origins of stolen funds highlight the perpetual cat-and-mouse game that characterizes cryptocurrency security.
The movement of these assets, particularly from an originally parked status to an active trading status, invites a closer examination of protocols like THORChain, as the industry collectively seeks to tighten security measures. Stakeholders, including individuals and institutional investors, must remain informed and vigilant as they navigate the complexities of crypto investments in an ever-volatile marketplace.
The movement came after substantial amounts of Bitcoin linked to a Coldcard wallet theft in 2026 began transitioning into Ethereum, as traced by Bitquery.
A total of 34 swaps were recorded between September 2 and 3, sending about 20.69 BTC into the Ethereum network.
Crypto investors can enhance protection by utilizing hardware wallets, implementing two-factor authentication, and staying informed on best practices regarding transaction security.