Coldcard theft suspect holds 1,159 BTC as mixing activity begins

Blockchain investigators are tracking new activity tied to the Coldcard wallet theft, with most stolen Bitcoin remaining unmoved. Galaxy Research reports that the largest known attacker holds 1,159 BTC across seven separate addresses, none of which have been sent to an exchange, mixer, or cash-out service. The funds were swept rapidly, within 41 minutes, according on-chain monitoring.

Law enforcement agencies, exchanges, and blockchain analytics firms have flagged roughly 600 addresses connected to the theft, creating a significant obstacle for the attacker. Any attempt to move the Bitcoin to a regulated exchange could trigger compliance reviews that might expose the theft's origins. Moving the funds carries substantial risk, analysts say, which likely explains why the addresses have remained inactive.

A separate person appears to be taking a different approach. Analysts spotted 64 BTC entering a transaction linked to a mixing service, with about 10 BTC mixed so far. The remaining funds were split into smaller pieces of roughly 7 BTC each. Mixers blend transactions together to obscure transaction origins, though analysts note the regular size of these outputs creates a detectable pattern for investigators to follow.

Galaxy Research previously confirmed that 1,596 BTC was stolen across three separate attack waves from approximately 7,300 addresses. The firm also identified 14 smaller incidents tied to the same firmware bug, with a possible fourth wave that could raise the total closer to 2,055 BTC, though these additional losses remain unconfirmed.