Galaxy Research estimates that the Coldcard hardware-wallet exploit resulted in the theft of approximately 1,789.28 Bitcoin from 8,865 addresses, with the stolen assets valued at roughly $114.7 million at the time of the attacks.
According to Galaxy Research, around 1,561 BTC, or 87.3% of the identified losses, remain unmoved. The Bitcoin is still sitting in addresses controlled by the attackers, including funds associated with the first three waves of the attack.
Some Bitcoin linked to later stages of the exploit has moved through techniques such as CoinJoin transactions and peel-chain transfers, which can make blockchain-based tracing more difficult.
More Than Half of Reported Victims Lost Over 1 BTC
Galaxy’s assessment also incorporates 221 reports from alleged victims, representing approximately 790.72 BTC, or about 44% of the total amount attributed to the exploit.
The median reported loss was approximately 1.04 BTC. This means that more than half of the documented victim reports involved losses greater than 1 Bitcoin.
The figures are based on reported cases rather than a complete accounting of every affected wallet, so the actual number of victims or total losses could potentially differ.
Most Stolen Bitcoin Remains Visible Onchain
Despite efforts to obscure some of the stolen funds, the largest portions of the Bitcoin remain traceable on the blockchain.
Galaxy has identified addresses associated with the attackers and shared the information with cryptocurrency exchanges, compliance providers and law-enforcement agencies. The objective is to help identify and potentially freeze stolen assets if they eventually reach centralized platforms.
The continued inactivity of approximately 87% of the attributed Bitcoin means the majority of the stolen funds have yet to enter a stage where they can easily be converted or transferred through conventional crypto services.
The case highlights both the transparency and limitations of blockchain tracking: stolen Bitcoin can remain visible onchain for years, while sophisticated transaction-routing techniques can make attribution and recovery considerably more difficult.
