Galaxy Research estimates that 1,789.28 Bitcoin, worth approximately $114.7 million at the time of theft, were stolen from 8,865 addresses in a hardware wallet exploit tied to Coldcard devices.
According to a Monday post by Alex Thorn, head of research at Galaxy, attackers have not spent 1,561 Bitcoin, representing 87.3% of the attributed losses. These funds remain in attacker-controlled collection addresses, including all Bitcoin stolen during the first three attack waves. Thorn noted that some Bitcoin stolen in later incidents has since moved through obfuscation methods such as CoinJoin transactions and peel chains.
The latest assessment draws on 221 victim reports covering 790.72 Bitcoin in losses, or 44.2% of the total attributed to the hack. The median loss per report was 1.04272 Bitcoin, indicating that more than half of the reported cases involved losses exceeding one Bitcoin.
Galaxy has identified and shared the attacker-controlled addresses with exchanges, compliance firms, and law enforcement in an effort to freeze the funds if they reach centralized intermediaries. The largest stolen holdings remain visible onchain in attacker-controlled addresses.
The Coldcard hack remains under investigation, with researchers continuing to trace the movement of stolen funds through blockchain forensics.
