TL;DR
- Galaxy Research attributes 1,789.28 BTC stolen from 8,865 addresses to the Coldcard exploit, worth $114.7 million, with median reported losses above 1 BTC.
- The 221 victim reports cover 790.72 BTC, and more than half involved losses exceeding 1 BTC, highlighting the exploit’s severe impact on self-custody users.
- Attackers left 1,561 BTC, or 87.3%, unmoved, while later funds used CoinJoin and peel chains; addresses were shared with exchanges and law enforcement.
Galaxy Research says the Coldcard exploit has now been linked to 1,789.28 BTC stolen from 8,865 addresses, worth $114.7 million at the time of theft. Yet the latest victim data reveals something even more personal: more than half of 221 reported cases involved losses above 1 BTC. The uncomfortable reality is that many victims were not losing small test balances, but meaningful Bitcoin holdings accumulated over time. The median reported loss reached 1.04272 BTC, highlighting how deeply the incident cut across users relying on hardware wallets for long-term self-custody across a particularly vulnerable user group.
📊 updated numbers on coldcard exploit
8865 addresses lost 1789.28 BTC worth $114.7m at the time of theft ($138.8m today)
– loss by address
median 0.00152
mean 0.20184
dormancy median 3.2yr
dormancy mean 3.6yr– loss by victim reports (221)
median 1.04272
mean 3.57792
dormancy… pic.twitter.com/d2R29dYyco— Alex Thorn (@intangiblecoins) August 24, 2026
Most stolen Bitcoin remains frozen in attacker-controlled wallets
Despite the scale of the theft, researchers say 1,561 BTC, or 87.3% of the attributed losses, has not moved from attacker-controlled collection or holding addresses. That includes all Bitcoin stolen during the first three identified attack waves. The paradox is that most of the stolen value remains visible onchain even though victims still cannot recover it. Some funds taken in later attacks have moved through CoinJoin transactions, peel chains and other obfuscation techniques, suggesting that the attackers have begun laundering only a portion of the total haul while leaving the majority untouched in those wallets.
The 221 victim reports cover 790.72 BTC in losses, equal to 44.2% of the total amount Galaxy attributes to the hack. Because the median case exceeded 1 BTC, the dataset indicates that a majority of those who came forward lost more than one whole bitcoin. That concentration turns the breach into a particularly severe self-custody event rather than a diffuse collection of minor compromises. At current investigation levels, the full victim population remains larger than the reported sample, meaning the available figures still capture less than half of the total Bitcoin Galaxy associates with the exploit.
Galaxy has shared identified attacker addresses with cryptocurrency exchanges, compliance firms and law enforcement agencies in hopes that funds can be frozen if they reach centralized intermediaries. The largest stolen balances remain publicly traceable in attacker-controlled wallets, leaving investigators with a visible but difficult target. The next phase depends on whether movement creates opportunities for intervention before obfuscation makes tracing harder. For victims, the fact that 87.3% remains unmoved offers a narrow source of hope, but visibility alone does not translate into recovery while the assets stay under the attackers’ control for now, however.
