Galaxy Research: 1,789 Bitcoin stolen in Coldcard hardware wallet hack, 87% still unmoved
Coldcard hardware wallet hack results in 1,789 Bitcoin stolen
Researchers at Galaxy have identified a hack targeting Coldcard hardware wallets that resulted in the theft of 1,789.28 Bitcoin (BTC). A hardware wallet is a physical device used to store cryptocurrency securely offline. The stolen funds were worth approximately $114.7 million at the time of the theft.
According to Alex Thorn, Galaxy’s head of research, 87.3% of the stolen Bitcoin—about 1,561 BTC—remains unmoved in addresses controlled by the attackers. These addresses hold all the Bitcoin taken during the first three waves of the attack.
Key details of the hack
- Total Bitcoin stolen: 1,789.28 BTC (worth $114.7 million at the time).
- 87.3% of stolen Bitcoin (1,561 BTC) remains unmoved in attacker-controlled addresses.
- 221 victim reports cover 790.72 BTC in losses, representing 44.2% of the total.
- Median loss per victim: 1.04272 BTC, meaning over half lost more than 1 BTC.
- Some stolen Bitcoin from later attacks has been moved using methods like CoinJoin and peel chains to hide its trail.
What Galaxy Research found
Galaxy Research based its findings partly on 221 reports from victims, which accounted for 790.72 BTC in losses. The largest stolen amounts are still visible on the blockchain in addresses controlled by the attackers. The blockchain is a public digital ledger that records all cryptocurrency transactions.
Galaxy has shared the identified attacker addresses with crypto exchanges, compliance companies, and law enforcement. The goal is to freeze the funds if they are transferred to centralized exchanges, which are platforms where users can buy, sell, or trade cryptocurrencies.
What is confirmed
- The theft of 1,789.28 BTC from Coldcard hardware wallets is attributed to the hack.
- 87.3% of the stolen Bitcoin remains in attacker-controlled addresses.
- 221 victim reports cover 44.2% of the total losses.
- Galaxy has shared attacker addresses with exchanges and law enforcement.
What remains unclear
- The exact method used by attackers to exploit Coldcard wallets has not been detailed in the available information.
- It is unknown whether the remaining unmoved Bitcoin will be liquidated or remain dormant.
- No confirmation on whether law enforcement has made progress in recovering the funds.
Why this matters for Coldcard users
This hack highlights the risks associated with hardware wallets, which are often considered one of the safest ways to store cryptocurrency. Users of Coldcard wallets may need to review their security practices or consider additional safeguards to protect their assets.
The fact that a significant portion of the stolen Bitcoin remains unmoved could indicate that attackers are waiting for an opportune time to move or liquidate the funds, or it may suggest they are unable to access them due to increased scrutiny.
