The Coldcard breach keeps widening. Investigators have now identified 4,585 wallets linked to the attack, with stolen Bitcoin totaling 1,367.05 BTC, or around $88.6 million at current prices.
The most recent wave drained 207.73 BTC from 1,912 wallets alone, pushing the totals beyond earlier estimates of 2,673 wallets and 1,158.81 BTC. Curiously, despite the massive haul, none of the stolen coins have been spent. The attacker appears to be consolidating funds, hinting at a carefully planned strategy rather than a quick cash-out.
Tracking the stolen Bitcoin
Data from Galaxy Research reveals the attacker funneled 1,159.42 BTC from 870 compromised wallets into eight verified addresses. Yet only a tiny fraction, 0.06 BTC, has moved beyond these points. This pattern suggests the hacker prefers to keep control tight, probably to avoid drawing attention while organizing the funds for future moves. That leaves a clear trail on the blockchain, which could aid investigators monitoring further transfers.
Should the attacker start moving large sums more frequently, the risk of laundering or dispersing the stolen assets would rise. Monitoring the frequency and routing of transactions will become critical. If funds are sent through regulated exchanges, KYC protocols might expose the thief, but routes through mixers or bridges would complicate tracking efforts.
The case enters a vital phase: any new activity could reveal whether the attacker shifts from hoarding to cashing out. Meanwhile, the thief’s restraint in moving the Bitcoin keeps a window open for blockchain sleuths to follow the trail.
This article is for informational purposes and does not constitute financial advice.
