The thieves took 1,789 Bitcoin. They've barely touched it.
A hardware wallet is the thing people buy so this exact story never happens to them. Then 8,865 addresses were emptied — and 87% of the stolen coins are just sitting there, in plain sight.
Galaxy Research says the Coldcard hack drained 1,789.28 Bitcoin from 8,865 addresses — $114.7 million at the time of the theft. That's the tally posted Monday by Alex Thorn, Galaxy's head of research.
Now the part that makes it strange. Of all that money, 1,561 Bitcoin — 87.3% — has not been spent. It's still sitting in addresses controlled by the attackers, and everyone can see it. Every coin taken in the first three waves of the attack is still there, untouched.
Coldcard is a hardware wallet: a small device you keep offline so your Bitcoin can't be stolen by someone on the internet. That is the entire point of owning one. It is the boring, careful, do-it-properly option — the crypto equivalent of not keeping cash under the mattress.
And these weren't whales sitting on stacks. Galaxy's count includes 221 victim reports covering 790.72 Bitcoin, and the median loss per report was 1.04272 Bitcoin. Median means the middle: half the people who reported lost more than a whole Bitcoin. Not a trading position. In many cases, someone's entire savings, held the way they were told was safest.
The safest place to keep Bitcoin turned out to have a door.
Here's why the 87% matters and isn't just trivia. Bitcoin sitting still is Bitcoin that can still be chased. Galaxy has handed the attacker addresses to exchanges, compliance firms and law enforcement, hoping the funds get frozen if they ever arrive at a company that has to check who its customers are. Coins already moved through CoinJoin — a service that mixes many people's coins together so nobody can tell whose is whose — and through peel chains, where a thief shaves off small amounts across a long trail of wallets, are much harder to follow. So far that's happened only to some of the later-wave money. The rest is a standoff: the thieves can see their money, and so can everyone else.
Anyone who did the responsible thing and bought a hardware wallet because a friend said cold storage is the only safe way — that advice just got an asterisk. It also hits the person in their twenties with their first couple of thousand in crypto, who was saving toward a deposit or a car and now has to ask a question they never expected: if the offline device isn't automatically safe, what actually is? And for the 221 people who filed reports, this isn't abstract — half of them are out more than a full Bitcoin.
The one thing to watch is whether the remaining 1,561 Bitcoin starts moving. Galaxy shared the attacker addresses with exchanges, compliance companies and law enforcement in the hope the funds can be frozen if they reach a centralized intermediary — so the test is simple: do those coins stay parked, get frozen, or vanish through mixing like the later-wave money already did. The source names no deadline, and nobody has said when or whether a freeze happens.
The thieves have $100 million-plus in an address the whole world is watching. They can look at it. They just can't easily spend it. Somewhere out there is a person who pulled off one of the biggest hardware wallet thefts on record and is now stuck — and 221 victims are watching the same screen, waiting to see who blinks.
Sources: Cointelegraph, «Galaxy puts Coldcard hack losses at 1,789 BTC, with 87% unmoved», Aug 25, 2026; Alex Thorn (Galaxy Research) via X.
Аппаратный кошелёк считался самым надёжным способом хранить биткоин — а тут $114,7 млн ушли с почти 9 тысяч адресов, и у половины пострадавших украли больше целого биткоина, причём 87% денег до сих пор лежат у воров и их можно попытаться заморозить.
Written by THE TELL’s AI newsroom. how we work · corrections