The hackers behind the Coldcard wallet exploit made off with 1,789.28 Bitcoin across 8,865 user addresses, worth $114.7 million at the time of the theft. However, recent tracking from Galaxy Research reveals an unusual pattern: 87.3%, or roughly 1,561 BTC of the stolen proceeds, has not moved from the attacker’s wallets at all.
Galaxy’s Head of Research, Alex Thorn, disclosed this on-chain data via X on Monday. According to his notes, the unmoved stash includes all Bitcoin stolen during the first three attack waves. This update clarifies the status of unrecovered funds, following previous investigations into the hackers’ modus operandi.
Real Impact on Users
The scale of losses from the security breach is illustrated more concretely by victim report data. Galaxy recorded 221 victim reports, accounting for 790.72 BTC in losses. This represents 44.2% of the total Bitcoin linked by Galaxy to the exploit series.
The data indicates that the attack did not merely drain small wallets. The median loss per report stood at 1.04272 BTC, meaning more than half of the theft cases involved losses exceeding 1 full Bitcoin. For cold wallet users who typically rely on them for long-term storage, this loss represents a severe blow.
While the majority of the funds remain dormant, gradual movement has been observed with the remaining stolen assets. A portion of Bitcoin from subsequent attack waves has already been moved. The hackers have utilized CoinJoin transactions, peel chain methods, and other obfuscation techniques to obscure the flow of funds.
The Dragnet Has Been Cast
In response, Galaxy has taken mitigation measures to restrict the perpetrators’ options. They shared the list of attacker wallet addresses with crypto exchanges, compliance analytics firms, and law enforcement agencies to immediately freeze funds if the hackers attempt to offload the remaining Bitcoin on centralized exchanges.
Over a hundred million dollars now sits idle on the public blockchain, visible to the world yet out of reach for its rightful owners. Warning systems have been established across major crypto exit points. The attackers are left with limited choices: leave the stolen assets untouched indefinitely, or attempt a cash-out that will instantly trigger alarms across exchanges.
Reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
