Galaxy Research has calculated that a series of hacks targeting Coldcard hardware wallet users resulted in the theft of approximately 1,789 Bitcoin, though the vast majority of those stolen funds remain dormant and unmoved by the attackers.
Scale of the Losses
According to the latest tally from Galaxy Research, more than half of the 221 victim reports collected involved individual losses exceeding a single Bitcoin. The concentration of high-value victims underscores that the attacks disproportionately affected users holding substantial amounts of cryptocurrency in their hardware wallets.
The aggregate figure of 1,789 BTC represents a significant sum, particularly given that Coldcard devices are marketed as a secure cold-storage solution favored by security-conscious Bitcoin holders. The breadth of affected users suggests the incident touched a meaningful segment of the self-custody community.
Roughly 87% of the stolen Bitcoin has yet to be moved by the attackers, leaving a rare window of visibility into the aftermath.
Funds Remain Frozen in Place
Perhaps the most notable detail from Galaxy's analysis is that about 87% of the compromised Bitcoin has not been shifted from the addresses where it landed. This inactivity offers investigators and the broader community an unusual opportunity to track the flow of funds and potentially coordinate responses before the assets are laundered or dispersed.
The reasons for the attackers holding rather than moving the coins remain unclear. It could reflect caution on the part of the perpetrators, technical hurdles in cashing out large sums, or an effort to avoid drawing further attention while blockchain analysts monitor the relevant wallets.
Key takeaways from the Galaxy tally include:
- An estimated 1,789 BTC lost across the reported incidents
- 221 victim reports compiled in the analysis
- More than half of victims lost over 1 BTC each
- About 87% of stolen funds remain unmoved
What It Means for Self-Custody Users
The episode serves as a stark reminder that hardware wallets, while a strong defense against many online threats, are not immune to compromise. Coldcard users are being urged to remain vigilant, verify device authenticity, and follow best practices when setting up and interacting with their cold-storage solutions.
As blockchain sleuths continue to track the dormant funds, the situation may evolve depending on whether the