Hackers behind the Coldcard wallet exploit made off with 1,789.28 Bitcoin from 8,865 user addresses, valued at $114.7 million at the time of the theft. However, recent tracking by Galaxy Research revealed a strange pattern: 87.3%, or approximately 1,561 BTC of the stolen loot, has not moved at all from the attacker’s wallets.
Galaxy’s head of research, Alex Thorn, disclosed this on-chain data on platform X on Monday. According to his notes, the unmoved stash includes all Bitcoin stolen during the first three attack waves. This updated data clarifies the status of the unrecovered funds, complementing earlier investigations that dissected the hackers’ modus operandi.
Real Impact on Users
The scale of the losses from the security vulnerability is painted more concretely by victim report data. Galaxy recorded 221 victim reports submitted, accounting for a loss of 790.72 BTC. This figure represents 44.2% of the total Bitcoin attributed by Galaxy to the string of exploits.
The data indicates that the attack did not merely sweep small wallets. The median loss per report stood at 1.04272 BTC, meaning more than half of the theft cases suffered losses exceeding 1 Bitcoin. For cold wallet users who typically rely on them for long-term storage, losing this amount is undoubtedly a heavy blow.
Although the majority of the funds remain untouched, slow movement has begun on the remaining stolen assets. A portion of the Bitcoin from subsequent attack waves has already been moved. The hackers are using CoinJoin transactions, peel chain methods, and various other obfuscation techniques to obscure the trail of fund flows.
The Net Has Been Cast
Facing this impasse, Galaxy took mitigation steps to narrow the perpetrators’ room to maneuver. They shared the list of hacker wallet addresses with various crypto exchanges, compliance analytics firms, and law enforcement agencies. The goal is to immediately freeze the funds if the hackers attempt to cash out the remaining Bitcoin through centralized exchanges.
Over a hundred million dollars in assets now sits idle on the public blockchain, visible to the world yet untouched by its rightful owners. Warning nets have been established across many crypto industry exit points. The attackers now face limited choices: leave the stolen assets dormant forever, or force a cash-out that will instantly trigger alarms across exchanges.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
