Most Bitcoin stolen in Coldcard wallet attacks still sits idle: 1,789.28 BTC taken, 87% unmoved
AI Market Summary
Galaxy Research estimates ~1,789.28 BTC was stolen in Coldcard-related attacks across 8,865 addresses, with ~87.3% still unmoved. Limited post-theft movement via CoinJoin/peel chains suggests delayed monetization, leaving a near-term window for on-chain attribution and potential exchange freezes as addresses are shared with CEXs, compliance firms, and law enforcement. The headline reinforces custody and operational-risk scrutiny around Bitcoin holdings.
Impact level
● Medium
Affected assets
BTC/USDT+0.20%
AI Insight · BTC/USDTAI Insight
● Neutral
Trade now
⚠️ AI-generated insights are based on news content and are provided for informational purposes only. They do not constitute investment advice or represent the views of BingX. Investing involves risk. Please trade responsibly.
Galaxy Research's research director Alex Thorn published updated figures on Aug. 25 (UTC+8) indicating that a series of hacking attacks targeting Coldcard hardware wallets led to the theft of about 1,789.28 BTC spread across 8,865 addresses. Thorn estimated the haul was worth roughly $114.7 million at the time the coins were stolen.
Tracking data shows 1,561 BTC—about 87.3% of the total—remains stationary in addresses believed to be controlled by the attackers. Coins taken in the first three waves of attacks have not moved at all. Some BTC from later incidents has been transferred using obfuscation methods including CoinJoin and peel chains.
The analysis is partly based on 221 victim submissions covering 790.72 BTC, representing 44.2% of the estimated losses. Reported median losses were 1.04272 BTC, and more than half of victims said they lost over 1 BTC.
Galaxy said it has shared identified attacker addresses with crypto exchanges, compliance firms and law enforcement, aiming to freeze funds if they reach centralized venues. The large share of unmoved BTC could suggest the attackers are waiting for a safer exit route, while also leaving a window for investigators to trace and potentially immobilize the assets. (Source: BlockBeats)