Galaxy finds 1,561 Bitcoin from Coldcard hack still unmoved

Galaxy Research attributed the Coldcard hack to the theft of 1,789.28 Bitcoin from 8,865 addresses. Alex Thorn, Galaxy Research's head of research, said attackers had not spent 1,561 Bitcoin. The unmoved amount represents 87.3% of the attributed losses. The funds were worth $114.7 million at the time of theft. The funds remain in attacker-controlled collection or holding addresses. All Bitcoin stolen during the first three attack waves remains unmoved. Some Bitcoin from later attacks moved through CoinJoin transactions, peel chains and other obfuscation methods. Galaxy's tally included 221 victim reports covering 790.72 Bitcoin in losses. Those reported losses represented 44.2% of the total Galaxy attributed to the hack. The median loss per report was 1.04272 Bitcoin. More than half of the reported cases involved losses exceeding 1 Bitcoin. The largest stolen holdings remain visible onchain in attacker-controlled addresses. Galaxy shared the identified attacker addresses with crypto exchanges, compliance companies and law enforcement. Galaxy hopes the funds can be frozen if they reach centralized intermediaries.