The core claim is straightforward. A Coldcard attacker is reported to have swapped roughly 10% of the stolen BTC via THORChain, according to crypto.news. At this stage the movement is a reported event rather than an independently confirmed on-chain reconstruction, and the underlying theft timeline and exploit method are not established in the available evidence. For related coverage, see Spot XRP ETFs Post Their Most Bullish Month of 2026.
Coldcard is a hardware wallet used to store Bitcoin offline, and THORChain is a decentralized protocol that lets users swap assets across different blockchains without a centralized intermediary. The significance here is the route, not the size: THORChain gives whoever controls the coins a way to exit Bitcoin into other tokens directly. Coldcard’s security has drawn scrutiny before, including a warning from the vendor over an entropy flaw tied to a BTC sweep.
What supports the THORChain swap claim
Beyond the primary report, the swap narrative has been echoed by on-chain observers. Posts from the account intangiblecoins on X flagged the movement, including one observation tied to the wallet activity. A separate write-up carried via TradingView framed the swap as a move from Bitcoin into ETH.
These are attributed observations from individual trackers and secondary write-ups, not a verified wallet-by-wallet trace. The current evidence does not include a full on-chain reconstruction with transaction hashes, sender and receiver addresses, and timestamps, so the wallet-tracking details should be read as claims made by those observers rather than settled fact. For related coverage, see BTC Back Above $80K as Macro Bid Lifts Crypto Sentiment.
The broader Coldcard drain has generated conflicting on-chain readings before, including reports of a 39,600 BTC shift into small wallets following the hack. That history is one reason to keep the framing cautious here.
Why the swap route matters more than the market reaction
This is a security story, not a price story. Moving stolen Bitcoin through a cross-chain protocol complicates tracing because the funds change form and network, breaking the simple “follow the BTC” approach that works when coins stay on one chain. That is the practical takeaway from the THORChain route.
It is worth being explicit about what the evidence does not show. There is no confirmed law-enforcement outcome, no recovery, and no established protocol liability in the available material. The importance sits in the movement path itself, not in any measured market impact.
The episode also feeds an ongoing debate about hardware-wallet risk. Developer Peter Todd has previously warned about single-signature Bitcoin risks in connection with the Coldcard drain, a reminder that key-management design shapes how exposed users are when a wallet line comes under attack.
For now, the responsible read is a narrow one: a reported swap of part of the stolen funds through THORChain, corroborated by on-chain watchers but not yet fully verified. Confirmation will depend on a complete transaction trace, which the current evidence does not provide.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
