1,789 BTC Stolen From Coldcard Users — 87% Still Hasn't Moved
The thief hasn't touched most of it — and that should scare you more than the theft itself.
Galaxy Research has put a hard number on the Coldcard hardware wallet hack: 1,789 BTC stolen across 221 confirmed victim reports. But the detail sending shockwaves through Bitcoin security circles isn't the total — it's the fact that 87% of those funds remain completely unmoved.
That's roughly 1,556 BTC sitting frozen, untouched, waiting. Whoever did this isn't in a rush. And experienced on-chain analysts know exactly what that patience signals: a sophisticated actor who understands blockchain forensics well enough to wait out exchange monitoring windows, chain-analysis flags, and the initial wave of investigator attention.
---
The Losses Are Bigger Than They Look
Galaxy's tally reveals another uncomfortable detail. More than half of the 221 victim reports involved individual losses exceeding 1 BTC. This wasn't a spray-and-pray attack hitting small retail holders for dust amounts. These were meaningful, targeted losses — the kind that suggests the attacker either had advance knowledge of wallet balances or specifically filtered for high-value targets.
For context, at current prices, 1,789 BTC represents roughly $175 million in exposure. With 87% unmoved, over $152 million in Bitcoin is effectively in limbo, owned by victims who can see exactly where their funds are and do absolutely nothing about it.
---
Why the Attacker Is Waiting
On-chain criminals who hold stolen funds for extended periods typically fall into one of two categories: nation-state actors with long time horizons and access to sophisticated laundering infrastructure, or individuals disciplined enough to wait for dust to settle before routing funds through mixers, bridges, or OTC desks in low-scrutiny jurisdictions.
Neither scenario is comforting. Both suggest this isn't over.
The longer the funds sit unmoved, the more likely a coordinated laundering event is being planned rather than improvised. Large sudden movements after a long dormancy period are a known signature of structured exits designed to overwhelm tracking systems simultaneously.
---
What Bitcoin Holders Need to Watch Right Now
If you use a hardware wallet, any hardware wallet, the Coldcard incident is a direct prompt to audit your setup. Verify your firmware source, check for supply chain tampering, and if you received your device secondhand or from an unverified seller, treat it as compromised until proven otherwise.
For the broader market, watch the 1,556 BTC cluster on-chain. Any significant movement from those wallets will likely trigger immediate exchange flagging and could create short-term selling pressure as analysts and media react in real time.
The attacker is patient. You should be watching.