Coldcard hack: 1,789 BTC stolen; 87% still unmoved

Galaxy Research attributes the theft of 1,789.28 Bitcoin to an exploit affecting Coldcard hardware wallets. Researchers found that 1,561 BTC, or 87.3% of the attributed funds, remain unmoved in addresses controlled by the attackers.

The theft traces to 8,865 victim addresses. At the time the coins were taken, their value was about $114.7 million. Galaxy’s analysis covers funds taken across several attack waves and maps flows from victim addresses to collection and holding addresses on the blockchain.

Galaxy’s head of research, Alex Thorn, reported that all Bitcoin stolen during the first three waves remains in place. Some coins taken in later incidents have been routed through CoinJoin transactions, peel chains and other obfuscation techniques intended to make tracing harder.

The firm’s tally incorporates 221 victim reports that together document 790.72 BTC in losses, equal to 44.2% of the total Galaxy attributed to the breach. The median loss among those reports was 1.04272 BTC, indicating more than half of reported victims lost at least one Bitcoin.

Onchain traces show the largest stolen balances still visible in addresses linked to the attackers. Galaxy provided the identified attacker addresses to cryptocurrency exchanges, compliance firms and law enforcement with the goal of having the funds frozen if they are deposited on centralized platforms.

Coldcard is a hardware wallet designed to store private keys offline. Following the exploit, investigators and affected users have relied on blockchain transaction records to identify losses and to report addresses associated with the theft.

Galaxy’s report presents a consolidated estimate of the stolen amounts, a breakdown of reported victim losses, and the onchain flows observed as attackers moved some funds through mixing and obfuscation tools. No recovered funds have been publicly confirmed at the time of the report.