Coldcard hack leaves most stolen Bitcoin unmoved after $114 million theft

Researchers at Galaxy Research have traced 1,789.28 BTC stolen from 8,865 addresses to a Coldcard hardware‑wallet exploit. The Bitcoin was valued at $114.7 million at the time of theft and is now estimated at about $138.8 million.

Unmoved majority of stolen funds

Of the total stolen amount, 1,561 BTC (≈87.3%) remains in collection or holding addresses controlled by the attackers. These funds have not been spent, providing a clear on‑chain record of where the bulk of the loot is stored.

Later waves show limited movement

Bitcoin taken in later attack waves has begun to move using privacy‑enhancing techniques such as CoinJoin transactions and peel chains, which obscure the flow of funds. Galaxy continues to monitor these transactions and shares identified attacker addresses with exchanges, compliance firms and law‑enforcement agencies.

Victim reporting and loss statistics

• 221 victims reported losses covering 790.72 BTC (44.2% of the total attributed theft).
• Median reported loss per victim: 1.04272 BTC; average loss: 3.57792 BTC.
• Median address dormancy before theft: 3.2 years; average dormancy: 3.6 years.

Technical cause of the exploit

TRM Labs identified a firmware configuration error introduced in March 2021 that caused certain Coldcard devices to fall back on a weaker software random‑number generator when creating wallet seeds. The reduced entropy could allow private keys to be recovered through brute‑force attacks without physical access to the device.

Implications for users

Updating firmware does not fix seeds that were originally generated with weak randomness. Affected users must create new seeds on secure hardware and migrate their Bitcoin to fresh addresses. Ongoing tracing efforts aim to flag any future movement of the unmoved 1,561 BTC so that centralized platforms can potentially freeze or recover the funds.