A major Coldcard hardware wallet exploit has left most of the stolen Bitcoin sitting untouched, even as blockchain researchers continue to trace the funds. Galaxy Research now attributes 1,789.28 BTC to the attack, worth about $114.7 million at the time of the theft.
The latest estimate covers 8,865 affected addresses. Researchers found that attackers have not moved 1,561 BTC, or 87.3% of the stolen funds. The Bitcoin remains in addresses believed to be controlled by the attackers, including the proceeds from the first three theft waves.
The vulnerability behind the theft
The attack exploited a flaw in Coldcard firmware dating back to 2021. The problem weakened the randomness used to generate some wallet seeds, allowing attackers to reconstruct vulnerable private keys without physical access to users’ devices.
The first major sweep began on July 30 and removed more than 1,000 BTC from affected wallets within minutes. Additional waves followed, pushing the estimated losses above $100 million.
Security researchers say the vulnerability primarily affected certain single-signature wallets. Coldcard urged affected users to generate new seeds and move their Bitcoin, since simply updating firmware does not repair an already compromised wallet.
Tracking the stolen Bitcoin
Although most of the stolen Bitcoin remains stationary, attackers have begun moving portions of the funds. Galaxy said some Bitcoin from later waves passed through CoinJoin transactions, peel chains and other techniques designed to make tracing more difficult.
Galaxy’s updated assessment also draws on 221 victim reports covering 790.72 BTC. The median reported loss was 1.04272 BTC, meaning more than half of those reports involved losses exceeding 1 BTC.
Researchers have shared identified attacker addresses with cryptocurrency exchanges, compliance firms and law enforcement agencies. The goal is to help identify and potentially freeze the funds if they eventually reach centralized platforms.
For now, the large amount of unmoved Bitcoin gives investigators a valuable opportunity to monitor the blockchain. However, the funds could become harder to trace if the attackers accelerate their laundering efforts.
