Coldcard hack: 87% of stolen Bitcoin remains unmoved

Researchers at Galaxy Research have traced 1,789.28 Bitcoin stolen from 8,865 addresses to an exploit involving Coldcard hardware wallets. At the time of the theft, the stolen assets were valued at approximately $114.7 million.

According to Alex Thorn, Galaxy’s head of research, 87.3% of the attributed losses—amounting to 1,561 Bitcoin—remain unmoved in attacker-controlled collection or holding addresses. This includes all Bitcoin stolen during the first three identified attack waves. While some funds from later attacks have begun moving through obfuscation methods such as CoinJoin transactions and peel chains, a large portion of the stolen assets remains traceable on-chain.

Galaxy has shared the identified attacker addresses with law enforcement, compliance firms, and cryptocurrency exchanges in an effort to freeze the funds if they attempt to move through centralized intermediaries.