Most of the bitcoin attributed to the 2026 Coldcard wallet exploit is still sitting in attacker-controlled addresses.
The latest public tally cited from Galaxy Research on August 25 attributes approximately 1,789.28 BTC stolen from 8,865 addresses to the Coldcard incident. About 1,561 BTC, or 87.3% of that total, had not moved from attacker-controlled addresses.
That is slightly higher than Galaxy's August 14 research figure of 1,778.84 BTC stolen and 1,531 BTC unmoved.
The difference is not evidence of a new large attack wave. The confirmed total has continued to change as additional victims and attacker footprints are attributed to the incident.
Why the headline number changed
Coldcard loss estimates have evolved throughout August because researchers have been separating high-confidence thefts from suspected waves and newly reported victim addresses.
Galaxy's August 14 research confirmed 1,778.84 BTC stolen from more than 8,600 addresses and said 1,531 BTC remained unmoved.
By August 25, an updated tally attributed approximately 1,789.28 BTC to 8,865 addresses, with around 1,561 BTC still stationary.
This is why older coverage may quote different figures.
For risk tracking, the date and confidence level of the estimate are as important as the number itself.
What caused the Coldcard exploit?
The core problem was seed generation.
Coldcard devices are intended to use hardware-generated randomness when creating wallet seeds. Coinkite's technical explanation says a build and link integration error introduced during a March 2021 software migration caused a random-number function to resolve to MicroPython's general-purpose Yasmarang pseudo-random generator rather than the intended hardware RNG path in affected firmware.
That reduced the effective entropy of some seeds.
Once attackers understood the weakness, they could search the reduced key space and reconstruct vulnerable private keys without touching the physical Coldcard device.
That explains one of the most disturbing characteristics of the incident: some victims followed normal cold-storage practices and still lost funds because the weakness existed when the seed itself was created.
The attackers did not need the devices
The exploit did not require stealing or remotely compromising each hardware wallet.
If a seed was generated with sufficiently weak entropy, an attacker could derive candidate private keys offline and monitor the blockchain for funded addresses.
That makes this fundamentally different from phishing, malicious transaction signing or seed-phrase theft.
The security failure occurred at wallet creation.
A wallet can remain physically air-gapped and still be vulnerable if its underlying private key was generated predictably.
Where did the stolen bitcoin go?
Most of it has not gone very far.
Galaxy's earlier tracing found that a portion of the stolen bitcoin moved into CoinJoin transactions, while some continued through peel-chain patterns or toward exchanges and interchain services.
However, the dominant fact remains that the majority of attributed bitcoin has stayed in attacker-controlled addresses.
That creates both an investigative opportunity and a future risk.
If the bitcoin moves toward a centralized exchange, compliance providers and law-enforcement partners may have an opportunity to identify or freeze funds.
If it moves through mixers or increasingly complex transaction chains, attribution and recovery become more difficult.
The next major on-chain alert will therefore be any material movement from the currently dormant clusters.
Are the attacks still happening?
Galaxy's August 14 research said it had not identified confirmed attacker activity after August 6.
That does not mean every vulnerable wallet is safe.
The attack waves may have stopped because many exposed users migrated funds, because high-value vulnerable wallets had already been drained, or because attackers changed behavior.
The underlying risk to an old vulnerable seed does not disappear simply because new mass sweeps have slowed.
Coinkite's latest firmware does not repair an old seed
This is the most important practical distinction in the incident.
Coinkite released updated Coldcard firmware and on August 20 recommended current standard versions including 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q.
The company also makes clear that installing fixed firmware does not make an already vulnerable seed safe.
If a seed was generated on affected firmware and lacks the additional entropy protections described by Coinkite, users need a newly generated safe seed and must migrate funds to new addresses.
The old private key cannot be made unpredictable after the fact.
Which devices and seeds are affected?
The exact risk depends on model, firmware version, how the seed was generated and whether additional entropy or a strong BIP-39 passphrase was used.
Coinkite maintains an updated security advisory and fixed-release matrix because the affected-version picture changed as the investigation progressed.
Users should therefore rely on the current first-party advisory rather than an early social-media list of affected models.
Why self-custody did not eliminate custody risk
The Coldcard incident illustrates a broader point about crypto custody.
Self-custody removes dependence on a centralized custodian, but it does not remove all custody risk.
It transfers part of that risk to:
- hardware design;
- firmware;
- randomness generation;
- wallet backups;
- transaction-signing software;
- user security procedures.
If the private key is weak at creation, physical possession of the device cannot compensate for the cryptographic failure.
CEXVia assessment
Risk level: Critical
The incident involved confirmed large-scale theft from self-custodied bitcoin wallets and a failure in one of the most security-sensitive stages of wallet creation.
The immediate mass-sweep activity appears to have slowed, but the event is not fully resolved.
Two issues remain especially important:
- any user still relying on an affected seed may remain exposed; and
- roughly 1,561 BTC attributed to the incident remains an active on-chain monitoring target.
A large movement from those attacker-controlled addresses should be treated as a fresh security alert.
FAQ
How much bitcoin was stolen in the Coldcard hack?
The latest public tally cited from Galaxy Research on August 25 attributes approximately 1,789.28 BTC to the incident.
How much stolen Coldcard bitcoin has not moved?
About 1,561 BTC, roughly 87% of the attributed total, remained unmoved in attacker-controlled addresses in the latest tally.
Why do some reports say 1,531 BTC?
Galaxy's August 14 research reported 1,531 BTC unmoved. The attributed total was later updated as additional addresses and victims were confirmed.
Does updating Coldcard firmware make an old wallet safe?
Not necessarily. Coinkite says updating firmware does not repair an existing vulnerable seed. Affected users need to follow the current migration guidance and create a new safe seed where applicable.
Did the hackers physically access Coldcard devices?
The central exploit did not require physical access to each device. Weak seed entropy allowed attackers to reconstruct vulnerable private keys offline.
*This article is for informational purposes only and does not constitute financial, legal or investment advice.*