Stolen Bitcoin Worth $1.6M Moves After Months of Dormancy

Tracing the Digital Footprint Through 34 Swaps

Blockchain analytics firm Bitquery detected movement of 20.45 BTC linked to a previously parked Coldcard wallet, with the attacker converting the funds through 34 separate Bitcoin swaps between September 2 and 3. The stolen assets were ultimately routed toward Ethereum, marking the first activity from these funds in months.

The transactions represent a significant development in a long-dormant crypto theft case. Bitquery's analysis revealed that the attacker utilized multiple swap operations to obfuscate the flow of funds, eventually transferring the equivalent of roughly $1.6 million into Ethereum-based assets. The main destination address was later observed holding approximately 5 ETH less than initially received, suggesting additional movement or fees incurred during the conversion process.

Bitquery's investigation mapped the entire journey of the 20.45 BTC as it passed through 34 distinct Bitcoin swap transactions over a two-day window. Each swap represented a deliberate step to fragment and obscure the transaction trail, a common tactic employed in crypto laundering operations. The analytics firm noted that the rapid succession of swaps—occurring entirely on September 2 and 3—indicates a coordinated effort rather than accidental or automated transfers.

The conversion from Bitcoin to Ethereum involved bridging mechanisms that allowed the attacker to exit the Bitcoin ecosystem while maintaining control over the value. Blockchain records show that after the final swap, the funds settled in addresses associated with Ethereum, where they remained for a brief period before further redistribution. The slight discrepancy of 5 ETH suggests either network fees, slippage, or partial liquidation of the converted assets.

What Does This Movement Mean for Crypto Security?

The reactivation of these dormant funds raises concerns about the persistence of old vulnerabilities and the ongoing risk posed by unpatched security gaps in hardware wallets. While the Coldcard device itself is not implicated in this specific incident, the movement underscores how stolen assets can remain inactive for extended periods before being moved.

Security experts note that the use of multiple swaps to convert Bitcoin into Ethereum reflects a growing trend among attackers seeking to exploit cross-chain bridges and decentralized exchanges. These methods allow for greater anonymity and faster integration into broader DeFi ecosystems.

The movement of these funds also highlights the challenges faced by law enforcement and blockchain investigators. While analytics firms like Bitquery can trace transaction paths, actually recovering stolen assets remains difficult once they are dispersed across multiple chains and protocols.

Frequently Asked Questions

Looking ahead, this incident serves as a reminder that dormant crypto holdings—whether stolen or simply forgotten—remain vulnerable to sudden movement. As cross-chain infrastructure continues to expand, the tools available to both attackers and defenders will evolve, making proactive security measures more critical than ever.

How did Bitquery trace the stolen Bitcoin? Bitquery analyzed blockchain data to map 20.45 BTC through 34 swap transactions, tracking the flow from the original Coldcard-linked wallet to Ethereum-based addresses.

Why convert Bitcoin to Ethereum? Converting to Ethereum allows attackers to access DeFi protocols, decentralized exchanges, and privacy tools that can further obscure fund origins and enable faster global movement.

Can these funds be recovered? Recovery is extremely difficult once funds are converted and dispersed across chains, especially when attackers use multiple swaps and bridging mechanisms to evade detection.