Coldcard exploit reveals years-long Bitcoin theft campaign — Details

Also, only a small percentage of the 8,680 addresses in Galaxy’s published theft set have been directly connected to victims who reported losses. This, even though they hold approximately 1,778.6 BTC

Additionally, all 192 individuals reported losses involving addresses in the dataset that was made public, which includes roughly 1,790 addresses and 714.8 Bitcoin.

AMBCrypto recently reported that these losses surpassed 1,596 BTC worth more than $100 million across roughly 7,300 addresses. Given Bitcoin’s price on 16th August though, the total losses have now surpassed $115 million.

What do we know about the attackers?

A few “fingerprints” were found during the investigation. These fingerprints were based on transaction behavior such as block timing, fees, lock times, RBF/sequence settings, transaction structure, and destination addresses.

Wave 1, for instance, stole roughly 1,082.65 BTC from blocks 960,183–960,191. They typically moved one victim per transaction into four collection addresses.

Similarly, Wave 3 managed 63 victims and Wave 2 handled 19 while Footprint E batched up to 795 victims per transaction, with a median of 118.

Patterns of destination also differed, with some groups dispersing funds over hundreds of locations while others concentrated them into a few addresses.

---

Final Summary

• Exploit affected 192 individuals, with roughly 714.8 Bitcoin compromised.
• Most of these significant losses happened between 2021 and 2022.