Coldcard Theft Probe Advances as $118 Million in BTC Remains in Attacker Addresses

Odaily reported that investigators have made progress in the July 2026 Coldcard hardware wallet theft case. About 1,082.65 BTC from the first wave of attacks, worth roughly $118 million, is still sitting in attacker-controlled addresses. The probe found that the attacker used a paid account at a blockchain data provider. Internal logs at the service matched the theft pattern closely, and the related leads have been handed to law enforcement. Galaxy Research analyst Alex Thorn said the first-wave attacker’s identity may already be known to authorities. The report also said later waves of attacks brought total stolen BTC to about 2,000. The second wave involved roughly 76 BTC, used a similar operating pattern, and may have been carried out by the same actor.