Key Takeaways
- • Galaxy Research has attributed 1,789.28 Bitcoin ($114.7 million at time of theft) stolen across 8,865 addresses to the Coldcard hardware wallet exploit, making it one of the largest documented hardware wallet breaches.
- • 87.3% of stolen funds (1,561 BTC) remain unmoved in attacker-controlled collection and holding addresses, suggesting the perpetrators have not yet attempted to liquidate the majority of holdings on centralized exchanges.
- • The breach affected a median loss of 1.04272 Bitcoin per reported victim, with more than half of 221 victim reports representing losses exceeding 1 BTC, indicating impact across both retail and higher-value holders.
- • Galaxy Research has shared identified attacker addresses with crypto exchanges, compliance firms, and law enforcement to enable potential fund freezing if stolen Bitcoin reaches centralized intermediaries.
- • A portion of stolen funds has moved through CoinJoin transactions and peel chains, suggesting attackers are employing obfuscation techniques on the remaining 12.7% of displaced funds.
Summary
Galaxy Research has quantified losses from the Coldcard hardware wallet exploit at 1,789.28 Bitcoin stolen from 8,865 addresses, according to research shared by Alex Thorn, Galaxy's head of research. At the time of theft, these holdings valued approximately $114.7 million. The breach represents one of the cryptocurrency industry's most significant hardware wallet security incidents to date.
The most notable aspect of the theft is the attacker's apparent reluctance or inability to liquidate holdings at scale. Galaxy's analysis found that 1,561 Bitcoin—representing 87.3% of total attributed losses—remains unmoved in attacker-controlled addresses. These funds have not transited through centralized exchanges or other intermediaries where they could be recovered. All Bitcoin stolen during the first three attack waves remain visible and stationary on the blockchain.
The dataset underpinning Galaxy's estimate includes 221 direct victim reports covering 790.72 Bitcoin in losses, or 44.2% of the total attributed amount. These reports established a median loss of 1.04272 Bitcoin per case, with more than half of victims reporting individual losses exceeding one full Bitcoin. This distribution suggests the exploit affected both retail users and institutional or high-net-worth holders. The remaining portion of the 1,789.28 BTC figure derives from on-chain analysis linking additional addresses to the same attack vectors.
For the minority of stolen funds that have moved, perpetrators employed standard obfuscation techniques including CoinJoin mixing services and peel chains to obscure transaction trails. This bifurcated behavior—holding the bulk of proceeds while moving a smaller portion through privacy mechanisms—may reflect operational caution or technical barriers to liquidation at scale without triggering exchange detection systems.
Galaxy has proactively shared identified attacker addresses with major cryptocurrency exchanges, compliance service providers, and law enforcement agencies. This coordinated disclosure strategy aims to establish monitoring protocols that would freeze or flag any attempted deposit of the stolen Bitcoin on regulated platforms, representing a potential recovery mechanism if attackers eventually attempt centralized liquidation.
The most notable aspect of the theft is the attacker's apparent reluctance or inability to liquidate holdings at scale. Galaxy's analysis found that 1,561 Bitcoin—representing 87.3% of total attributed losses—remains unmoved in attacker-controlled addresses. These funds have not transited through centralized exchanges or other intermediaries where they could be recovered. All Bitcoin stolen during the first three attack waves remain visible and stationary on the blockchain.
The dataset underpinning Galaxy's estimate includes 221 direct victim reports covering 790.72 Bitcoin in losses, or 44.2% of the total attributed amount. These reports established a median loss of 1.04272 Bitcoin per case, with more than half of victims reporting individual losses exceeding one full Bitcoin. This distribution suggests the exploit affected both retail users and institutional or high-net-worth holders. The remaining portion of the 1,789.28 BTC figure derives from on-chain analysis linking additional addresses to the same attack vectors.
For the minority of stolen funds that have moved, perpetrators employed standard obfuscation techniques including CoinJoin mixing services and peel chains to obscure transaction trails. This bifurcated behavior—holding the bulk of proceeds while moving a smaller portion through privacy mechanisms—may reflect operational caution or technical barriers to liquidation at scale without triggering exchange detection systems.
Galaxy has proactively shared identified attacker addresses with major cryptocurrency exchanges, compliance service providers, and law enforcement agencies. This coordinated disclosure strategy aims to establish monitoring protocols that would freeze or flag any attempted deposit of the stolen Bitcoin on regulated platforms, representing a potential recovery mechanism if attackers eventually attempt centralized liquidation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.