Galaxy Research says the Coldcard hack led to the theft of 1,789.28 Bitcoin from 8,865 addresses, with the stolen funds valued at $114.7 million at the time of the attack. In an X post on Monday, Galaxy head of research Alex Thorn said 1,561 BTC, or 87.3% of the losses attributed to the exploit, has not been spent and still sits in attacker-controlled collection or holding addresses. That includes all Bitcoin taken during the first three waves of attacks.
The latest estimate also draws on 221 victim reports covering 790.72 BTC in losses, equal to 44.2% of Galaxy’s total attribution. The median loss per report came in at 1.04272 BTC, which means more than half of the reported victims lost more than 1 Bitcoin. Thorn added that some funds stolen in later attack waves have moved through CoinJoin transactions, peel chains and other obfuscation methods. Galaxy said it has shared identified attacker addresses with crypto exchanges, compliance firms and law enforcement in hopes that the funds can be frozen if they reach centralized intermediaries.
Galaxy Research says the Coldcard hack resulted in the theft of 1,789.28 Bitcoin from 8,865 addresses, and most of that Bitcoin has yet to move.
In a Monday post on X, Galaxy head of research Alex Thorn said the stolen funds were worth $114.7 million at the time of the theft. He said attackers have not spent 1,561 BTC, or 87.3% of the losses Galaxy attributed to the incident. The coins remain in attacker-controlled collection or holding addresses, including all of the Bitcoin taken during the first three attack waves.
Some later-stage stolen funds have been obfuscated
Thorn said some Bitcoin stolen in later attacks has since moved through CoinJoin transactions, peel chains and other obfuscation methods.
Victim reports account for part of Galaxy’s estimate
The latest tally is based in part on 221 victim reports that cover 790.72 BTC in losses. That figure represents 44.2% of the total losses Galaxy attributed to the hack.
The median loss per report was 1.04272 BTC, which indicates that more than half of the reported cases involved losses above 1 Bitcoin.
Addresses shared with exchanges and law enforcement
Galaxy said the largest stolen holdings are still visible onchain in attacker-controlled addresses. The firm has shared the identified attacker addresses with crypto exchanges, compliance companies and law enforcement, aiming to freeze the funds if they pass through centralized intermediaries.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
