Galaxy Research attributes 1,789 BTC loss to Coldcard hack, 87% remains unmoved

Galaxy Research has quantified the impact of the Coldcard hardware wallet exploit, attributing the theft of 1,789.28 Bitcoin—worth roughly $115 million at the time of the breach—to 8,865 addresses. The majority of the stolen funds have not been moved.

Scale of the theft

The research team identified 1,789.28 BTC taken in the hack, representing the largest known hardware‑wallet loss to date. Of this amount, 1,561 BTC (about 87 % of the total) remains in attacker‑controlled collection or holding addresses.

Victim reports and loss distribution

Galaxy’s tally incorporates 221 victim reports covering 790.72 BTC, which accounts for 44 % of the total attributed loss. The median loss per report was 1.04272 BTC, meaning more than half of the reported cases involved losses exceeding one Bitcoin.

Movement of stolen funds

While the bulk of the stolen Bitcoin is still idle, some of the later‑stage thefts have been moved using privacy‑enhancing techniques such as CoinJoin, peel chains, and other obfuscation methods.

Response and mitigation efforts

Galaxy Research has shared the identified attacker addresses with cryptocurrency exchanges, compliance firms, and law‑enforcement agencies in hopes of freezing the funds should they be transferred to centralized intermediaries.