Most Stolen Coldcard Bitcoin Remains Untouched After $114M Exploit

Galaxy Research confirmed that 1,789.28 BTC was siphoned from 8,865 addresses during the security breach, which resulted from a firmware configuration error introduced in March 2021. This flaw forced devices to rely on weak software-based randomness, enabling attackers to recover private keys through brute-force methods. While the bulk of the funds—valued at approximately $138.8 million today—remains stationary, some later thefts have been routed through CoinJoin mixers and peel chains in an attempt to obscure the transaction trail.

Alex Thorn, head of research at Galaxy, noted that the stolen assets had high dormancy periods, with many addresses holding the Bitcoin for over three years before the theft. Galaxy has shared identified attacker addresses with exchanges and regulatory firms to facilitate potential asset freezes. Because the initial waves of the attack did not utilize obfuscation techniques, investigators maintain a clear onchain view of the largest concentrated holdings. TRM Labs, which identified the firmware vulnerability, warned that simply updating software cannot secure a wallet if the seed was generated with the original, weakened entropy; users must instead migrate funds to new, securely generated addresses.