More than 87% of the Bitcoin attributed to the Coldcard hack has remained unmoved, leaving 1,561 BTC under attacker control after researchers linked the exploit to $114.7 million in losses.
Galaxy Research Traces 1,789 BTC
Galaxy Research has traced 1,789.28 BTC stolen from 8,865 addresses to the Coldcard exploit. The Bitcoin was worth $114.7 million when it was taken, while its current value stands at approximately $138.8 million. Of the total, 1,561 BTC, or 87.3%, has not been spent and remains in collection or holding addresses controlled by the attackers.
All Bitcoin tied to the first three identified attack waves has remained unmoved, giving researchers an onchain record of where a large portion of the stolen funds is being held. Galaxy has shared identified attacker addresses with cryptocurrency exchanges, compliance companies and law enforcement.
Victim Reports Show Heavier Losses
Across the 8,865 addresses identified by Galaxy, the median loss was 0.00152 BTC and the average stood at 0.20184 BTC. The affected Bitcoin had remained dormant for long periods before being stolen, with median address dormancy of 3.2 years and an average of 3.6 years. Victim reports show heavier losses on an individual basis, with 221 reports covering 790.72 BTC, equivalent to 44.2% of the total Bitcoin attributed to the exploit.
Attackers Begin Obfuscating Later Thefts
While the largest holdings remain parked, Galaxy has found different transaction behavior among funds taken during later attacks. Attackers have used CoinJoin transactions, peel chains and other methods designed to make the movement of Bitcoin harder to follow across addresses. CoinJoin combines transactions from multiple participants to obscure individual inputs and outputs, while peel chains involve repeatedly moving smaller amounts from a larger balance into new addresses.
The lack of movement across the first three waves is particularly important to the tracing effort because the corresponding Bitcoin has not yet passed through obfuscation techniques. Researchers can continue monitoring known addresses for outgoing transactions.
The Root Cause: Weak Randomness
TRM Labs reported that the incident involved several waves beginning July 30, tracing the thefts to a firmware problem that weakened the randomness used when generating some Coldcard wallet seeds. A build configuration error introduced through firmware in March 2021 caused affected devices to fall back on a weaker software random number generator instead of relying fully on hardware-generated entropy.
The resulting key strength could fall low enough for private keys to be recovered through brute-force computing without physical access to the wallet. Differences between transaction structures across the attack waves led the company to say multiple attackers could have been involved.
Hardware Wallet Security Under Scrutiny
The incident has put attention on a hardware wallet brand built specifically around Bitcoin self-custody. Weak randomness can become especially dangerous in cryptocurrency wallets because seed phrases ultimately determine the private keys controlling the assets. If the random input used to create a seed contains too little entropy, an attacker with enough computing resources may be able to search the reduced range of possible combinations.
Other wallet security incidents this summer have involved different attack methods, including a laser attack against a Tangem wallet card demonstrated by Ledger's Donjon researchers in July. The Coldcard losses highlight that even hardware wallets designed for offline key storage can carry vulnerabilities introduced during manufacturing or firmware updates.
