Bitcoin linked by Bitquery to the 2026 Coldcard hardware-wallet theft began an active cross-chain trail this week after a tracked Wave 3 stash of about 20.5 BTC started moving. On Sept. 2, 20.49703196 BTC left an address Bitquery classifies as reported and attacker-controlled for Wave 3, then passed through two fresh Bitcoin addresses that were later emptied. The live tracker recorded 34 THORChain swaps on Sept. 2–3 that routed 20.45 BTC of traced value into Ethereum, part of a broader 20.69 BTC across 36 swaps including two earlier August swaps totaling 0.24 BTC. Most of the total, 20.15 BTC across 26 swaps, went toward Ethereum address 0x160a7A4c067B084F03400c6980Ac29F73F6782f6, which held about 649.5 ETH at a Sept. 3 16:15 UTC check and 644.4974 ETH by 17:25 UTC. Another 0.30 BTC went to a second Ethereum address. At Bitcoin block 965,339, Bitquery counted 1,402.59 BTC still sitting in identified addresses, including 1,396.33 BTC that had never moved, while the THORChain-routed amount was watched separately on Ethereum. The controller remains unidentified, and links across drain waves are unresolved; an independent dataset separates Waves 1–3 from a 64.90373764 BTC Wave 4, and Galaxy Research has said it cannot definitively link all wave footprints. The Sept. 2–3 activity follows earlier reporting that Galaxy Research head of research Alex Thorn flagged third-wave swaps of roughly 10% of stolen Bitcoin into Ether via THORChain as the first exit from original addresses across three waves, with funds routed to a new Ethereum address shared with law enforcement and crypto firms. Coinkite has said affected seeds still need migration because corrected firmware cannot repair existing credentials. Galaxy Research previously linked the exploit to 1,789.28 Bitcoin stolen from 8,865 addresses worth about $114.7 million, with most funds long parked and no public recovery or arrest announced.