Coldcard exploit now tied to 4,585 wallets; $88.6M in stolen BTC remains unmoved

Investigators have expanded the known scope of the Coldcard exploit, with Galaxy Research attributing the incident to 4,585 Bitcoin addresses drained in three waves. In total, 1,367.05 BTC—valued at about $88.6 million—was stolen. The latest wave accounted for 207.73 BTC taken from 1,912 addresses, pushing estimates up from 2,673 wallets and 1,158.81 BTC. A key finding is that the stolen BTC remains 100% unspent. Investigators say this points to consolidation rather than immediate liquidation, suggesting a more deliberate operation. As attribution work continues, additional connected addresses could emerge, widening the suspected timeline and overall scale. On-chain data from Onchain Lens shows the exploit cluster received 1,159.42 BTC (about $72.71 million) from 870 compromised addresses and consolidated the funds into eight verified wallets. To date, only 0.06 BTC has been moved to a new address, leaving roughly 1,159.35 BTC untouched. The pattern indicates an emphasis on control and organization while minimizing exposure ahead of any larger transfers, keeping most of the stolen funds visible for monitoring. With broader distribution not yet underway, analysts say the next on-chain moves will be decisive. Transfers to regulated exchanges could trigger KYC-based identification and potential intervention. Routing through mixers or cross-chain bridges would break the trail and make tracing more difficult, putting greater weight on transaction frequency, clustering behavior, and routing patterns rather than balances alone. Continued inactivity preserves clearer investigative leads, while coordinated outbound transfers would escalate the case into a far more complex tracing challenge. Final Summary: The suspected Coldcard exploit appears larger than previously estimated, and future Bitcoin movements will determine how effectively investigators can continue tracking the stolen funds.