Galaxy Research says Bitcoin losses tied to Coldcard have climbed past $115 million, based on activity tracked from July 30 through Aug. 13. The firm said 1,778.58 BTC was swept from 8,680 addresses over that period.

The data points to a large, long-dormant pool of wallets being drained in grouped waves. Galaxy said the affected coins do not appear to predate Coldcard’s March 17, 2021 firmware release, adding an important timing marker to the incidents it tracked.

Scope of the losses

According to Galaxy’s dataset, the 1,778.58 BTC taken since July 30 was spread across 8,680 addresses. At the values cited in the research, that total represents more than $115 million in losses.

Galaxy said its chart sorts the 10 largest sweep groups by transaction behavior. Most of the drained addresses, however, still have no identified owner, limiting how much of the activity can be tied to publicly known victims.

What the timeline suggests

Galaxy reported that none of the stolen coins it identified were older than March 17, 2021, the date of Coldcard’s firmware release at block 674,951. In the firm’s view, the coins and keys from affected devices appear only after that point.

The drained addresses had also been inactive for long stretches before being emptied. Galaxy put the median untouched period at about 3.5 years, or 1,292 days, suggesting many of the wallets sat dormant for years before the sweep activity began.

Largest waves and transaction patterns

The biggest sweep group, labeled Wave 1 in Galaxy’s research, made up about 61% of the total losses. The firm said that wave accounted for roughly $70.2 million and drained 1,195 addresses in just 41 minutes across nine blocks.

Another cluster, Footprint E, hit a larger number of addresses overall, touching 2,147. Galaxy said that group also batched as many as 795 addresses into a single transaction, highlighting the organized transaction patterns seen across the tracked waves.

Where the Bitcoin appears to be now

Much of the Bitcoin taken in Wave 1 has not moved further, according to Galaxy. Of the 1,082.65 BTC taken in that wave, 1,082.57 BTC remains in place.

Galaxy said Wave 3 showed a different pattern, with Bitcoin distributed to ordinary wallets. It added that 207.73 BTC from that activity is now sitting in script-hash vaults.

Known victims versus unattributed addresses

So far, only 192 reports have been filed, representing 714.81 BTC, or 40.2% of the Bitcoin Galaxy said was taken. That leaves a large gap between the on-chain activity and the number of identified or self-reported cases.

Galaxy said the remaining 6,890 addresses hold 1,063.76 BTC with no owner attached. The next confirmed step is likely to come from additional victim reports or further on-chain tracing that can connect more of those drained addresses to named owners.

Source: beincrypto.com