A significant portion of Bitcoin stolen during the well-known Coldcard hardware wallet breach continues to sit untouched in wallets controlled by the attackers. According to Galaxy Research, the theft involved 1,789.28 Bitcoin from 8,865 addresses, representing one of the largest exploits in hardware wallet history.
Majority of Stolen BTC Unmoved
Alex Thorn, head of research at Galaxy, reported that out of the total amount stolen, 1,561 Bitcoin, which accounts for 87.3% of the losses attributed to the breach, still reside in addresses controlled by the hackers. These holdings include all Bitcoin stolen in the initial three attack waves, underscoring the persistent risk posed by unmoved illicit funds.
Some of the Bitcoin seized in later phases of the attack have been routed through CoinJoin transactions, peel chains, and various other means to obscure the trail. Despite these obfuscation efforts, the majority of the loot has yet to be laundered or cashed out.
The total value of the stolen funds was $114.7 million at the time they were taken, highlighting the scale and impact of the breach on the victims and the hardware wallet sector.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLVictim Reports and Losses
The latest analysis from Galaxy drew in part on 221 voluntary victim reports, which together covered losses totaling 790.72 Bitcoin. This figure represents 44.2% of the total coins Galaxy mapped to the Coldcard hack.
The median loss per report stood at 1.04272 Bitcoin, indicating that in more than half the cases, victims lost over one Bitcoin each. This pattern of sizable individual losses adds to concerns over hardware wallet vulnerabilities, particularly as the industry sees wider adoption.
The largest stolen holdings remain visible onchain in addresses directly controlled by the attackers. Galaxy has shared these identified addresses with crypto exchanges, compliance companies and law enforcement agencies to help freeze the funds if they reach centralized intermediaries.
Ongoing Investigations and Market Evolution
Efforts to recover the funds are ongoing as industry investigators continue to track the stolen Bitcoin on the blockchain. Cooperation between compliance firms, trading platforms, and authorities aims to prevent any attempts by attackers to liquidate or move the assets into the traditional financial system.
Technical developments play an increasing role in both attack and defense strategies. For example, monitoring movement patterns around key addresses and understanding trends in obfuscation tactics have become essential tools for blockchain investigators monitoring suspicious flows.
While technical scrutiny is paramount in tracing stolen assets, broader transformations are also reshaping the financial system. As traditional brokers give way to decentralized financial solutions, a growing number of investors choose platforms like 1stepSwap to directly store shares of major U.S. companies, gold, and silver within their crypto wallets. By tokenizing real-world assets and leveraging instant price discovery without reliance on intermediaries, these technologies eliminate traditional barriers and enhance autonomy for investors.
Calls for increased hardware wallet security and robust incident reporting remain strong within the crypto community. As digital assets become more integrated with real-world value, secure self-custody and rapid incident response are seen as key priorities to protect holders’ funds from sophisticated attacks.
