Galaxy Estimates Coldcard Hack Losses at 1,789 BTC: 87% of Bitcoins Unmoved

cryptonews.ruPublished on 2026-08-25Last updated on 2026-08-25

Abstract

Researchers from Galaxy estimate that hackers stole 1,789.28 BTC (worth $114.7 million at the time) from the Coldcard hardware wallet exploit, linked to 8,865 addresses. According to Alex Thorn, head of Galaxy Research, the vast majority of the stolen funds—1,561 BTC, or 87.3% of the total—remain unmoved and are held in addresses controlled by the attackers. This includes all bitcoins stolen during the attack's first three waves. Some funds from later waves have been moved using obfuscation methods like CoinJoin transactions and peel chains. The assessment is partly based on 221 victim reports detailing losses of 790.72 BTC (44.2% of the estimated total), with a median loss per report of over 1 bitcoin. Galaxy has shared the identified attacker addresses with exchanges, compliance firms, and law enforcement to facilitate freezing the funds if they reach centralized intermediaries.

The vast majority of bitcoins stolen in the Coldcard hack remain unmoved. This conclusion was reached by researchers tracking one of the largest hardware wallet hacks.

Galaxy Research linked a transfer of 1,789.28 bitcoin from 8,865 addresses to the Coldcard hack, according to a Monday post on X from Galaxy's head of research, Alex Thorn. The funds were worth $114.7 million at the time of the theft.

Thorn stated that the malicious actors have not spent 1,561 bitcoin—87.3% of the losses linked to the attack. The funds remain at collection or storage addresses under the actors' control, including all bitcoins stolen during the first three waves of the attack.

Thorn added that some bitcoins stolen in later attacks have since been moved via CoinJoin transactions, peel chains, and other obfuscation methods.

Source: Alex Thorn

The latest estimate is partially based on 221 victim reports detailing losses of 790.72 bitcoin—44.2% of the total volume Galaxy linked to the hack. The median loss per report was 1.04272 bitcoin, meaning more than half of the victims lost over 1 bitcoin.

The largest stolen sums are still visible on the blockchain at addresses controlled by the malicious actors. Galaxy has shared the identified malicious addresses with cryptocurrency exchanges, compliance companies, and law enforcement so the funds can be frozen upon reaching centralized intermediaries.

Related: Coldcard Hack Losses: How Investigators Are Tracking the Stolen Bitcoin

end-content

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
CapricornAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
comp
CompoundCOMP
mantra
MantraMANTRA
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
velodrome
Velodrome FinanceVELODROME
brev
BrevisBREV
cake
PancakeSwapCAKE
dos
DAPPOSDOS

Related Questions

QAccording to Galaxy Research, what is the total amount of BTC stolen in the Coldcard hack and its value at the time of the theft?

AThe total amount stolen was 1,789.28 BTC, valued at $114.7 million at the time of the theft.

QWhat percentage of the stolen Bitcoin from the Coldcard hack has not been moved by the attackers?

A87.3% of the stolen Bitcoin (1,561 BTC) has not been moved by the attackers.

QWhat methods have the attackers used to try and obfuscate the trail of some of the stolen bitcoins?

AThey have used CoinJoin transactions, peel chains, and other obfuscation methods for bitcoins stolen in later waves of the attack.

QHow much stolen Bitcoin was reported by victim complaints that Galaxy Research used in its estimate, and what was the median loss per complaint?

AVictim complaints reported losses of 790.72 BTC. The median loss per complaint was 1.04272 BTC, meaning more than half of the victims lost over 1 BTC.

QWhat actions has Galaxy taken regarding the identified attacker-controlled addresses from the Coldcard hack?

AGalaxy has shared the identified attacker addresses with cryptocurrency exchanges, compliance companies, and law enforcement agencies so the funds can be frozen if they reach centralized intermediaries.

Related Reads

Cryptocurrency Exchange Trading Volume Doubles in Five Days! Will the Recovery Continue? Here Are the Details

Trading volumes on centralized cryptocurrency exchanges (CEX) have surged, doubling over five days to surpass $37 billion daily, a recovery from annual lows. However, this level remains far below the 12-month peak of $105 billion. Overall August volume is also showing recovery signs. Analysts note that in the current market cycle, CEX spot volumes face new competition from spot crypto ETFs, which are diverting institutional capital for major assets like Bitcoin and Ethereum into traditional finance channels. The growth of ETFs and Digital Asset Trusts (DATs) may exert long-term pressure on CEX volumes. Meanwhile, demand for altcoins is expected to stay largely on CEX platforms due to their advantages in listing speed, wide range of trading pairs, and advanced tools for small-cap tokens. The recent market rally, with Bitcoin and Ethereum rising over 23% and 30% respectively last week, supported the volume increase. Altcoin market cap also grew approximately 13%. A third factor potentially diverting volume from CEXs is the rapid adoption of decentralized exchanges like Hyperliquid and Lighter. Nonetheless, all trading infrastructures could benefit if the market's upward trend continues.

cryptonews.ru8m ago

Cryptocurrency Exchange Trading Volume Doubles in Five Days! Will the Recovery Continue? Here Are the Details

cryptonews.ru8m ago

U.S. 'Operation Economic Outcast' Targets Iran's Crypto Sector, Over $100 Million in Oil-Related Payments Allegedly Facilitated via Cryptocurrency

U.S. Treasury Launches "Operation Economic Outcast," Sanctions Iran's Crypto Sector On August 24, the U.S. Treasury Department initiated "Operation Economic Outcast," a government-wide economic campaign against Iran. As part of this, the Office of Foreign Assets Control (OFAC) issued a sectoral sanctions determination targeting digital assets under Executive Order 13902, significantly expanding its authority. The Treasury stated that Iran is increasingly using cryptocurrency as a "tool of choice" to evade sanctions and support transactions linked to the Islamic Revolutionary Guard Corps (IRGC). Concurrently, OFAC sanctioned Ukrainian-Emirati broker Ivan Obukhov and his company, Foscom FZE. The Treasury alleges that since 2023, Obukhov has processed over $100 million in cryptocurrency payments to facilitate oil sales on behalf of the IRGC-Quds Force. Nearly 60 other entities, individuals, and vessels involved in nuclear procurement, cyber operations, and oil revenue networks were also sanctioned. This move marks an escalation from prior actions against specific exchanges, now establishing a broad basis to sanction any foreign entity deemed to operate in or support Iran's digital asset sector. Treasury Secretary Scott Bessent warned that any entity engaging economically with the Iranian regime will face the full reach of U.S. power, calling the operation an "economic D-Day" aimed at isolating Tehran.

marsbit22m ago

U.S. 'Operation Economic Outcast' Targets Iran's Crypto Sector, Over $100 Million in Oil-Related Payments Allegedly Facilitated via Cryptocurrency

marsbit22m ago

Why Draper University is Investing $70,000 in an In-Person Accelerator Program

Draper University has launched the Apex Growth Accelerator, a 10-week in-person residency program in Silicon Valley in partnership with Cardano Foundation and Orion Fund. It offers up to $70,000 in seed funding for a 3.5% equity stake, targeting early-stage Web3 startups building on Cardano. Applications close September 1, with the program starting October 12 in San Mateo. The accelerator focuses on high-growth sectors like real-world asset (RWA) tokenization, institutional DeFi, and enterprise blockchain infrastructure. Executives emphasize that these areas are merging into foundational infrastructure for asset ownership and trading. The focus is on building the base layer for institutional and mainstream financial adoption, moving beyond just proving tokenization works. Despite industry trends toward remote programs, Draper University mandates the core 10-week in-person residency, arguing it creates greater intensity, faster decision-making, and quicker investor connections than remote work. The cohort aims for 10 companies, culminating in a Demo Day. Success metrics prioritize founders' ability to raise capital, acquire customers, and sustain growth post-program, rather than just graduation numbers. The equity-based model aims to align founder success with the long-term health and total value locked (TVL) of the Cardano ecosystem.

cryptonews.ru23m ago

Why Draper University is Investing $70,000 in an In-Person Accelerator Program

cryptonews.ru23m ago

Is Your Account Still Blocked? Rosfinmonitoring Gets Direct Access to SBP and 'Mir'

Starting September 1, 2026, Russia's Federal Law No. 461-FZ grants Rosfinmonitoring (the Federal Financial Monitoring Service) direct access to transaction data from the National Payment Card System (NSPK), the operator of the Mir payment card system and the Faster Payments System (SBP). This allows the agency to bypass individual banks when reconstructing transaction trails for anti-money laundering (AML) purposes. The data, provided free of charge and without requiring customer consent or court orders, includes information on operations via SBP, the unified QR-code, and Mir cards, with no minimum transaction threshold. Customers will not be notified when their data is shared. The law does not introduce new taxes, automatic account freezes, or new enforcement powers. If suspicious activity is identified under existing AML laws, existing procedures with banks and law enforcement will apply. The agreement's specific terms between Rosfinmonitoring and NSPK, including the scope and historical depth of accessible data, are not public. The change centralizes access to a vast volume of domestic payments, potentially speeding up financial investigations. However, it also creates a single point of concentration for sensitive data and reduces transparency for cardholders, as customers are not informed about data requests. Observers note a global trend of expanding supervisory powers, with differences in the Russian model being the non-public agreement and the lack of customer notification.

cryptonews.ru25m ago

Is Your Account Still Blocked? Rosfinmonitoring Gets Direct Access to SBP and 'Mir'

cryptonews.ru25m ago

Trading

Spot

Hot Articles

What is $BITCOIN

DIGITAL GOLD ($BITCOIN): A Comprehensive Analysis Introduction to DIGITAL GOLD ($BITCOIN) DIGITAL GOLD ($BITCOIN) is a blockchain-based project operating on the Solana network, which aims to combine the characteristics of traditional precious metals with the innovation of decentralized technologies. While it shares a name with Bitcoin, often referred to as “digital gold” due to its perception as a store of value, DIGITAL GOLD is a separate token designed to create a unique ecosystem within the Web3 landscape. Its goal is to position itself as a viable alternative digital asset, although specifics regarding its applications and functionalities are still developing. What is DIGITAL GOLD ($BITCOIN)? DIGITAL GOLD ($BITCOIN) is a cryptocurrency token explicitly designed for use on the Solana blockchain. In contrast to Bitcoin, which provides a widely recognized value storage role, this token appears to focus on broader applications and characteristics. Notable aspects include: Blockchain Infrastructure: The token is built on the Solana blockchain, known for its capacity to handle high-speed and low-cost transactions. Supply Dynamics: DIGITAL GOLD has a maximum supply capped at 100 quadrillion tokens (100P $BITCOIN), although details regarding its circulating supply are currently undisclosed. Utility: While precise functionalities are not explicitly outlined, there are indications that the token could be utilized for various applications, potentially involving decentralized applications (dApps) or asset tokenization strategies. Who is the Creator of DIGITAL GOLD ($BITCOIN)? At present, the identity of the creators and development team behind DIGITAL GOLD ($BITCOIN) remains unknown. This situation is typical among many innovative projects within the blockchain space, particularly those aligning with decentralized finance and meme coin phenomena. While such anonymity may foster a community-driven culture, it intensifies concerns about governance and accountability. Who are the Investors of DIGITAL GOLD ($BITCOIN)? The available information indicates that DIGITAL GOLD ($BITCOIN) does not have any known institutional backers or prominent venture capital investments. The project seems to operate on a peer-to-peer model focused on community support and adoption rather than traditional funding routes. Its activity and liquidity are primarily situated on decentralized exchanges (DEXs), such as PumpSwap, rather than established centralized trading platforms, further highlighting its grassroots approach. How DIGITAL GOLD ($BITCOIN) Works The operational mechanics of DIGITAL GOLD ($BITCOIN) can be elaborated on based on its blockchain design and network attributes: Consensus Mechanism: By leveraging Solana’s unique proof-of-history (PoH) combined with a proof-of-stake (PoS) model, the project ensures efficient transaction validation contributing to the network's high performance. Tokenomics: While specific deflationary mechanisms have not been extensively detailed, the vast maximum token supply implies that it may cater to microtransactions or niche use cases that are still to be defined. Interoperability: There exists the potential for integration with Solana’s broader ecosystem, including various decentralized finance (DeFi) platforms. However, the details regarding specific integrations remain unspecified. Timeline of Key Events Here is a timeline that highlights significant milestones concerning DIGITAL GOLD ($BITCOIN): 2023: The initial deployment of the token occurs on the Solana blockchain, marked by its contract address. 2024: DIGITAL GOLD gains visibility as it becomes available for trading on decentralized exchanges like PumpSwap, allowing users to trade it against SOL. 2025: The project witnesses sporadic trading activity and potential interest in community-led engagements, although no noteworthy partnerships or technical advancements have been documented as of yet. Critical Analysis Strengths Scalability: The underlying Solana infrastructure supports high transaction volumes, which could enhance the utility of $BITCOIN in various transaction scenarios. Accessibility: The potential low trading price per token could attract retail investors, facilitating wider participation due to fractional ownership opportunities. Risks Lack of Transparency: The absence of publicly known backers, developers, or an audit process may yield skepticism regarding the project's sustainability and trustworthiness. Market Volatility: The trading activity is heavily reliant on speculative behavior, which can result in significant price volatility and uncertainty for investors. Conclusion DIGITAL GOLD ($BITCOIN) emerges as an intriguing yet ambiguous project within the rapidly evolving Solana ecosystem. While it attempts to leverage the “digital gold” narrative, its departure from Bitcoin's established role as a store of value underscores the need for a clearer differentiation of its intended utility and governance structure. Future acceptance and adoption will likely depend on addressing the current opacity and defining its operational and economic strategies more explicitly. Note: This report encompasses synthesised information available as of October 2023, and developments may have transpired beyond the research period.

2.1k Total ViewsPublished 2025.05.13Updated 2025.05.13

What is $BITCOIN

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of BTC (BTC) are presented below.

活动图片

Top Questions