The vast majority of Bitcoin stolen in the Coldcard hack remains unmoved, according to researchers tracking one of the largest hardware wallet exploits.
Galaxy Research has attributed the theft of 1,789.28 Bitcoin from 8,865 addresses to the Coldcard hack, according to a Monday X post by Alex Thorn, Galaxys head of research. The funds were worth $114.7 million at the time of theft.
Thorn said attackers have not spent 1,561 Bitcoin, or 87.3% of the attributed losses. The funds remain in attacker-controlled collection or holding addresses, including all Bitcoin stolen during the first three attack waves.
Some Bitcoin stolen in later attacks has since moved through CoinJoin transactions, peel chains and other obfuscation methods, Thorn added.
The latest tally draws partly on 221 victim reports covering 790.72 Bitcoin in losses, or 44.2% of the total Galaxy attributed to the hack. The median loss per report was 1.04272 Bitcoin, meaning more than half of the reported cases involved losses exceeding 1 Bitcoin.
The largest stolen holdings remain visible onchain in attacker-controlled addresses. Galaxy has shared the identified attacker addresses with crypto exchanges, compliance companies and law enforcement in hopes that the funds can be frozen if they reach centralized intermediaries.