Roughly 20.5 BTC connected to the Coldcard theft was reportedly moved through THORChain and into Ethereum, a cross-chain hop that takes the stolen bitcoin off its original network and complicates efforts to trace the funds.

The movement was flagged by on-chain watchers monitoring wallets tied to the theft. According to a post on X by on-chain researcher intangiblecoins , funds connected to the incident were routed toward Ethereum rather than left sitting on Bitcoin. For related coverage, see Bitcoin ETFs Rebound as Ethereum and XRP ETF Winning Streaks End .

What reportedly moved

The amount in question is approximately 20.5 BTC, and it is described as linked to the Coldcard theft rather than confirmed by any legal ruling. That distinction matters: "linked" reflects blockchain tracing, not a court finding. For related coverage, see ASIC crypto deadline: Sept. 30 for Australian firms .

The affected addresses are viewable on public explorers, including a Bitcoin address tracked on Mempool.space . A separate community-maintained timeline of the Coldcard incident has been documenting the flow of funds as they move.

The broader incident has already prompted warnings from the hardware wallet maker. Coldcard urged Mk3 users to move their funds during the drain investigation , and later released firmware 5.6.1 while telling affected users to move their bitcoin .

Why the THORChain-to-Ethereum route stands out

THORChain is a decentralized protocol that allows users to swap one cryptocurrency for another across different blockchains without a central exchange. Using it, someone can turn native bitcoin into an asset that lives on Ethereum. Because swaps are executed by smart contracts and liquidity pools rather than an intermediary, there is no exchange operator that can freeze funds or be compelled to reverse a transaction — a contrast with centralized exchanges, where law enforcement has at times recovered stolen crypto.

That is the key analytical detail: the funds did not merely move between Bitcoin wallets; they crossed from the Bitcoin network into the Ethereum ecosystem.

Cross-chain hops like this can make monitoring harder. When value jumps networks, investigators must pick up the trail on a second blockchain instead of following a single chain of Bitcoin transactions. Chain-hopping through cross-chain bridges and swap protocols has been a recurring pattern in past high-profile crypto thefts, which is why on-chain analysts watch these routes closely.

What this means for crypto holders

For everyday holders, the takeaway is straightforward. Stolen funds rarely sit still, and moving them across chains is a common way to muddy the trail for anyone trying to trace or recover them.

The case also keeps attention on hardware wallet security. The Coldcard incident sits alongside other law-enforcement-driven crypto stories, such as when the FBI seized Hamas crypto fundraising infrastructure , where tracing on-chain movement was central to the response.

If you use a hardware wallet, keep its firmware current and follow the maker's official guidance. Watching where funds go, using public block explorers, remains one of the few tools available to the public after a theft.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.