Galaxy puts Coldcard hack losses at 1,789 BTC, with 87% unmoved

The vast majority of Bitcoin stolen in the Coldcard hack remains unmoved, according to researchers tracking one of the largest hardware wallet exploits.

Thorn said attackers have not spent 1,561 Bitcoin, or 87.3% of the attributed losses. The funds remain in attacker-controlled collection or holding addresses, including all Bitcoin stolen during the first three attack waves.

Some Bitcoin stolen in later attacks has since moved through CoinJoin transactions, peel chains and other obfuscation methods, Thorn added.

Source: Alex Thorn

The latest tally draws partly on 221 victim reports covering 790.72 Bitcoin in losses, or 44.2% of the total Galaxy attributed to the hack. The median loss per report was 1.04272 Bitcoin, meaning more than half of the reported cases involved losses exceeding 1 Bitcoin.

The largest stolen holdings remain visible onchain in attacker-controlled addresses. Galaxy has shared the identified attacker addresses with crypto exchanges, compliance companies and law enforcement in hopes that the funds can be frozen if they reach centralized intermediaries.