Galaxy Estimates Coldcard Hack Losses at 1,789 BTC: 87% of Bitcoins Unmoved

cryptonews.ruPublished on 2026-08-25Last updated on 2026-08-25

Abstract

Researchers from Galaxy estimate that hackers stole 1,789.28 BTC (worth $114.7 million at the time) from the Coldcard hardware wallet exploit, linked to 8,865 addresses. According to Alex Thorn, head of Galaxy Research, the vast majority of the stolen funds—1,561 BTC, or 87.3% of the total—remain unmoved and are held in addresses controlled by the attackers. This includes all bitcoins stolen during the attack's first three waves. Some funds from later waves have been moved using obfuscation methods like CoinJoin transactions and peel chains. The assessment is partly based on 221 victim reports detailing losses of 790.72 BTC (44.2% of the estimated total), with a median loss per report of over 1 bitcoin. Galaxy has shared the identified attacker addresses with exchanges, compliance firms, and law enforcement to facilitate freezing the funds if they reach centralized intermediaries.

The vast majority of bitcoins stolen in the Coldcard hack remain unmoved. This conclusion was reached by researchers tracking one of the largest hardware wallet hacks.

Galaxy Research linked a transfer of 1,789.28 bitcoin from 8,865 addresses to the Coldcard hack, according to a Monday post on X from Galaxy's head of research, Alex Thorn. The funds were worth $114.7 million at the time of the theft.

Thorn stated that the malicious actors have not spent 1,561 bitcoin—87.3% of the losses linked to the attack. The funds remain at collection or storage addresses under the actors' control, including all bitcoins stolen during the first three waves of the attack.

Thorn added that some bitcoins stolen in later attacks have since been moved via CoinJoin transactions, peel chains, and other obfuscation methods.

Source: Alex Thorn

The latest estimate is partially based on 221 victim reports detailing losses of 790.72 bitcoin—44.2% of the total volume Galaxy linked to the hack. The median loss per report was 1.04272 bitcoin, meaning more than half of the victims lost over 1 bitcoin.

The largest stolen sums are still visible on the blockchain at addresses controlled by the malicious actors. Galaxy has shared the identified malicious addresses with cryptocurrency exchanges, compliance companies, and law enforcement so the funds can be frozen upon reaching centralized intermediaries.

Related: Coldcard Hack Losses: How Investigators Are Tracking the Stolen Bitcoin

end-content

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
CapricornAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
comp
CompoundCOMP
mantra
MantraMANTRA
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
cake
PancakeSwapCAKE
dos
DAPPOSDOS

Related Questions

QAccording to Galaxy Research, what is the total amount of BTC stolen in the Coldcard hack and its value at the time of the theft?

AThe total amount stolen was 1,789.28 BTC, valued at $114.7 million at the time of the theft.

QWhat percentage of the stolen Bitcoin from the Coldcard hack has not been moved by the attackers?

A87.3% of the stolen Bitcoin (1,561 BTC) has not been moved by the attackers.

QWhat methods have the attackers used to try and obfuscate the trail of some of the stolen bitcoins?

AThey have used CoinJoin transactions, peel chains, and other obfuscation methods for bitcoins stolen in later waves of the attack.

QHow much stolen Bitcoin was reported by victim complaints that Galaxy Research used in its estimate, and what was the median loss per complaint?

AVictim complaints reported losses of 790.72 BTC. The median loss per complaint was 1.04272 BTC, meaning more than half of the victims lost over 1 BTC.

QWhat actions has Galaxy taken regarding the identified attacker-controlled addresses from the Coldcard hack?

AGalaxy has shared the identified attacker addresses with cryptocurrency exchanges, compliance companies, and law enforcement agencies so the funds can be frozen if they reach centralized intermediaries.

Related Reads

“Economic Outcast”: US Treasury Takes Aim at Iran's Cryptocurrency, Technology, and Gold

On August 24, 2026, the U.S. Treasury Department, under Secretary Scott Bessent, launched "Operation Economic Outcast," a major campaign targeting the financial networks of the Islamic Republic of Iran and its affiliates. The primary goal is to cut off revenue streams supporting the Iranian regime, with a specific focus on denying funding to the Islamic Revolutionary Guard Corps (IRGC). The Office of Foreign Assets Control (OFAC) activated authorities to sanction any entities, regardless of location, operating in or servicing five key Iranian economic sectors: digital assets (cryptocurrency), technology, gold, aviation, and shipping. OFAC noted Iran's increasing use of cryptocurrency to evade sanctions, including for operations linked to the IRGC and government officials. Initial measures targeted nearly 60 organizations, individuals, and vessels across multiple jurisdictions involved in procuring nuclear/missile technology, conducting cyber operations, and facilitating illicit oil sales. The U.S. State Department joined the campaign, announcing additional sanctions against Iranian military officials, intelligence entities targeting U.S. forces, and networks moving Iranian oil. Treasury warned foreign partners that they have a specific deadline to halt identified Iran-related activities, or face unilateral U.S. action. Entities facilitating sanctions evasion risk being cut off from the U.S. financial system and the dollar economy. The operation consolidates sanctions against Iran's crypto, tech, and commodity financing into a unified campaign with clear deadlines. It expands OFAC's reach to crypto brokers and payment networks handling Iranian oil. Analysis suggests crypto tools are already embedded in Iran's trade practices, as seen with capital flight from the Nobitex exchange and discussions of Bitcoin payments for Strait of Hormuz transit, indicating new OFAC powers target existing, not hypothetical, evasion channels.

cryptonews.ru7m ago

“Economic Outcast”: US Treasury Takes Aim at Iran's Cryptocurrency, Technology, and Gold

cryptonews.ru7m ago

Upbit Accelerates Token Listings: Total Trading Volume Halved, New Tokens Support Nearly 30% Share

In the second half of 2026, Upbit significantly accelerated its pace of listing new cryptocurrencies, even as the overall Korean won-denominated trading market cooled rapidly. Monthly trading volume on Upbit plunged 63%, from KRW 72.7 trillion in January to KRW 27.1 trillion in July, with Bitcoin prices also falling. Contrary to the conventional logic of listing more during bull markets, Upbit intensified new listings during this downturn. New listings have become a crucial lever for Upbit to sustain trading activity in a bear market. By August, 61 new tokens listed in 2026 were collectively contributing nearly 30% of Upbit's total won trading volume, up from just 5% in January. This means roughly a quarter of the platform's fee revenue now comes from these newly listed assets. Standout performers like CHIP, RE, SLX, and CAP achieved significant individual market share shortly after listing, while new stablecoin listings contributed negligible volume. This strategy highlights a shift: the "Upbit listing premium," once a sought-after event to attract new capital, is increasingly used as a defensive tool to stabilize fee income amid shrinking overall volume. While the premium effect persists, indicating remaining genuine demand, its frequent use risks diluting the long-term strategic value and scarcity of Korean won liquidity access. Upbit's approach reflects a broader challenge for Asian centralized exchanges: relying on short-term listing tools to maintain operations during macro weakness, potentially at the cost of eroding long-term competitive foundations.

marsbit27m ago

Upbit Accelerates Token Listings: Total Trading Volume Halved, New Tokens Support Nearly 30% Share

marsbit27m ago

Flowra Launches Open Orderflow Auction For Solana Validators

Flowra has launched an Open Orderflow Auction framework for Solana validators, introducing a third-party MEV auction and block-building system. Operating as middleware and not a protocol fork, it features 200ms mini-auction cycles where registered searchers compete for transaction inclusion. The system integrates with Honeypot, allowing validators customizable block policies. This aims to bring more transparency and structure to Solana's high-speed transaction ordering market, aligning with broader trends of professionalizing MEV infrastructure. Success depends on adoption by validators and searchers to move meaningful orderflow through the framework.

bitcoinist28m ago

Flowra Launches Open Orderflow Auction For Solana Validators

bitcoinist28m ago

Digital Ruble Payment for Communications to Begin in Russia

Major Russian telecom operators are preparing to accept payments in the digital ruble (CBDC). MTS will enable the option for all services integrated with its MTS Pay system, with no restrictions on goods or services. Rostelecom is developing its platform with a major bank, initially for one-time payments on its website, with plans to expand to customer accounts and recurring payments later. Megafon will also adopt it as an additional payment method. This follows recent announcements from major marketplaces Wildberries and Ozon, which will start accepting the digital ruble from September 1. From that date, major Russian businesses are legally required to process transactions in this third form of national currency. Applications of the 12 systemically important Russian banks must include a button to access digital ruble wallets. The Central Bank of Russia plans to set a monthly top-up limit of 300,000 rubles per bank for these wallets.

cryptonews.ru29m ago

Digital Ruble Payment for Communications to Begin in Russia

cryptonews.ru29m ago

Founder of Crypto Fund Block Bits Capital Found Guilty of $1 Million Fraud

The founder of cryptocurrency fund Block Bits Capital, 48-year-old Jafet Dillman, was found guilty by a federal jury in San Francisco of wire fraud and conspiracy to commit wire fraud. After a 10-day trial, the jury determined that between June 2017 and August 2018, Dillman and an accomplice raised nearly $1 million from over 20 investors. They falsely claimed that the fund would generate profits through automated cryptocurrency trading using a proprietary tool called Autotrader. Dillman knew the algorithm was non-functional but continued to assure investors it was operational. The funds were instead used for personal compensation and risky investments in other crypto projects, leading to significant losses while investors were misled about profitable trading. Currently released on bail, Dillman's sentencing is scheduled for December 8, 2026, facing up to 20 years imprisonment and a $250,000 fine per count.

cryptonews.ru30m ago

Founder of Crypto Fund Block Bits Capital Found Guilty of $1 Million Fraud

cryptonews.ru30m ago

Trading

Spot

Hot Articles

What is $BITCOIN

DIGITAL GOLD ($BITCOIN): A Comprehensive Analysis Introduction to DIGITAL GOLD ($BITCOIN) DIGITAL GOLD ($BITCOIN) is a blockchain-based project operating on the Solana network, which aims to combine the characteristics of traditional precious metals with the innovation of decentralized technologies. While it shares a name with Bitcoin, often referred to as “digital gold” due to its perception as a store of value, DIGITAL GOLD is a separate token designed to create a unique ecosystem within the Web3 landscape. Its goal is to position itself as a viable alternative digital asset, although specifics regarding its applications and functionalities are still developing. What is DIGITAL GOLD ($BITCOIN)? DIGITAL GOLD ($BITCOIN) is a cryptocurrency token explicitly designed for use on the Solana blockchain. In contrast to Bitcoin, which provides a widely recognized value storage role, this token appears to focus on broader applications and characteristics. Notable aspects include: Blockchain Infrastructure: The token is built on the Solana blockchain, known for its capacity to handle high-speed and low-cost transactions. Supply Dynamics: DIGITAL GOLD has a maximum supply capped at 100 quadrillion tokens (100P $BITCOIN), although details regarding its circulating supply are currently undisclosed. Utility: While precise functionalities are not explicitly outlined, there are indications that the token could be utilized for various applications, potentially involving decentralized applications (dApps) or asset tokenization strategies. Who is the Creator of DIGITAL GOLD ($BITCOIN)? At present, the identity of the creators and development team behind DIGITAL GOLD ($BITCOIN) remains unknown. This situation is typical among many innovative projects within the blockchain space, particularly those aligning with decentralized finance and meme coin phenomena. While such anonymity may foster a community-driven culture, it intensifies concerns about governance and accountability. Who are the Investors of DIGITAL GOLD ($BITCOIN)? The available information indicates that DIGITAL GOLD ($BITCOIN) does not have any known institutional backers or prominent venture capital investments. The project seems to operate on a peer-to-peer model focused on community support and adoption rather than traditional funding routes. Its activity and liquidity are primarily situated on decentralized exchanges (DEXs), such as PumpSwap, rather than established centralized trading platforms, further highlighting its grassroots approach. How DIGITAL GOLD ($BITCOIN) Works The operational mechanics of DIGITAL GOLD ($BITCOIN) can be elaborated on based on its blockchain design and network attributes: Consensus Mechanism: By leveraging Solana’s unique proof-of-history (PoH) combined with a proof-of-stake (PoS) model, the project ensures efficient transaction validation contributing to the network's high performance. Tokenomics: While specific deflationary mechanisms have not been extensively detailed, the vast maximum token supply implies that it may cater to microtransactions or niche use cases that are still to be defined. Interoperability: There exists the potential for integration with Solana’s broader ecosystem, including various decentralized finance (DeFi) platforms. However, the details regarding specific integrations remain unspecified. Timeline of Key Events Here is a timeline that highlights significant milestones concerning DIGITAL GOLD ($BITCOIN): 2023: The initial deployment of the token occurs on the Solana blockchain, marked by its contract address. 2024: DIGITAL GOLD gains visibility as it becomes available for trading on decentralized exchanges like PumpSwap, allowing users to trade it against SOL. 2025: The project witnesses sporadic trading activity and potential interest in community-led engagements, although no noteworthy partnerships or technical advancements have been documented as of yet. Critical Analysis Strengths Scalability: The underlying Solana infrastructure supports high transaction volumes, which could enhance the utility of $BITCOIN in various transaction scenarios. Accessibility: The potential low trading price per token could attract retail investors, facilitating wider participation due to fractional ownership opportunities. Risks Lack of Transparency: The absence of publicly known backers, developers, or an audit process may yield skepticism regarding the project's sustainability and trustworthiness. Market Volatility: The trading activity is heavily reliant on speculative behavior, which can result in significant price volatility and uncertainty for investors. Conclusion DIGITAL GOLD ($BITCOIN) emerges as an intriguing yet ambiguous project within the rapidly evolving Solana ecosystem. While it attempts to leverage the “digital gold” narrative, its departure from Bitcoin's established role as a store of value underscores the need for a clearer differentiation of its intended utility and governance structure. Future acceptance and adoption will likely depend on addressing the current opacity and defining its operational and economic strategies more explicitly. Note: This report encompasses synthesised information available as of October 2023, and developments may have transpired beyond the research period.

2.1k Total ViewsPublished 2025.05.13Updated 2025.05.13

What is $BITCOIN

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of BTC (BTC) are presented below.

活动图片

Top Questions