The vast majority of Bitcoin stolen in the Coldcard hack has not moved, according to Galaxy Research. According to Galaxy, 1,789.28 Bitcoin, valued at about $114.7 million at the time of the incident, were taken by attackers from 8,865 addresses. 1,561 Bitcoin, or 87.3% of the total, is still in addresses under the attackers’ control. Galaxy said the funds include all of the Bitcoin stolen during the first three waves of attacks.
📊 updated numbers on coldcard exploit
8865 addresses lost 1789.28 BTC worth $114.7m at the time of theft ($138.8m today)
– loss by address
median 0.00152
mean 0.20184
dormancy median 3.2yr
dormancy mean 3.6yr– loss by victim reports (221)
median 1.04272
mean 3.57792
dormancy… pic.twitter.com/d2R29dYyco— Alex Thorn (@intangiblecoins) August 24, 2026
Alex Thorn, head of research at Galaxy, shared the latest figures in a post on X. He said some Bitcoin stolen during later attacks has moved through CoinJoin transactions, peel chains and other methods designed to make tracking the funds more difficult.
The latest estimate is partly based on 221 reports from victims. Those reports account for 790.72 Bitcoin, or about 44.2% of the total losses Galaxy has attributed to the hack. The median loss reported by victims was 1.04272 Bitcoin. That means more than half of the reported cases involved losses of more than one Bitcoin.
Galaxy has shared the identified attacker addresses with cryptocurrency exchanges, compliance companies and law enforcement agencies. If the stolen Bitcoin gets to a centralized exchange or another intermediary that might take action, the goal is to make it simpler to identify it and possibly freeze it.
It is noteworthy that 87.3% of the ascribed Bitcoin has not changed. Because blockchain transactions are publicly available, even when criminals try to hide the trail, moving significant sums of stolen bitcoin may draw attention.
A portion of the money has already been transferred via methods like CoinJoin, which aggregates transactions from several users to make it more difficult to track the movement of individual coins. Peel chains, another technique mentioned by Galaxy, can also be used to gradually move funds through a series of addresses.
For victims, however, the continued visibility of the stolen Bitcoin offers at least some hope that the funds could eventually be identified if attackers attempt to cash them out through regulated platforms.
Galaxy’s latest estimate also highlights the scale of the incident. Thousands of addresses were affected, while the reported losses run into hundreds of millions of dollars when measured at the time of theft.
The investigation remains focused on tracking the stolen assets and identifying opportunities for recovery. For now, most of the Bitcoin attributed to the Coldcard hack remains where it was placed by the attackers.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment