The Coldcard wallet exploit has left one attacker holding 1,159 BTC worth roughly $72.7 million, spread across seven addresses and completely untouched since the initial theft. Galaxy Research identified this as the largest known haul from the vulnerability. The Bitcoin arrived in those wallets within 41 minutes, a stunning speed that speaks to how quickly the exploit worked across 870 compromised devices.

What makes this unusual is the inaction. The attacker has moved just 0.06 BTC to a new address, leaving the rest sitting in place. No transfers to exchanges. No attempts to convert to other cryptocurrencies. No movement toward known cash-out channels. Blockchain analysts and law enforcement have flagged roughly 600 connected addresses, making any exchange deposit extremely risky. A compliant platform would immediately flag the funds and request information about the receiving account. The Bitcoin exists on the ledger but remains economically frozen.

The mixing game begins

Meanwhile, a separate attacker has started moving. On-chain investigators detected 64 BTC entering a transaction flow linked to a mixer. About 10 BTC went through the mixing process initially, with 54 BTC returning as change. The pattern suggests someone is testing the waters, moving smaller amounts rather than attempting to wash the entire haul at once. It's a slower, more cautious approach than the first attacker's apparent paralysis.

The distinction matters. The larger holder faces a genuine problem, no matter how patient they are. Flagged addresses create friction at every legitimate exit point. The mixing attempt by the second attacker shows at least one person involved in the theft understands the surveillance landscape and is working around it, piece by piece. Whether either strategy ultimately succeeds depends on law enforcement coordination with exchanges and whether the attackers have access to peer-to-peer channels outside regulated markets.

This article covers on-chain analysis of stolen funds and law enforcement response. It is informational only and not financial advice.