A forensic accounting by Galaxy Research has put a concrete number on one of the hardware wallet industry's most damaging security incidents: 1,789 Bitcoin lost across 221 documented victim reports in what has become known as the Coldcard hack. The figure alone is striking, but it is the secondary finding — that 87% of those funds have not moved a single satoshi since being stolen — that raises the deeper and more unsettling questions about what comes next for victims, investigators, and the broader self-custody ecosystem.
Hardware wallets have long been marketed as the gold standard of personal Bitcoin custody. The premise is simple and powerful: keep your private keys offline, away from internet-connected attack surfaces, and your coins are yours alone. The Coldcard incident forces an uncomfortable re-examination of that premise — not necessarily because the hardware itself failed in a conventional sense, but because the scale of losses documented here demonstrates that attackers found a viable path through, around, or alongside the device's defenses. The precise attack vector remains a subject of active investigation, but Galaxy's tally leaves little ambiguity about the outcome.
The victim profile data is particularly revealing. Galaxy Research found that more than half of the 221 reported cases involved individual losses exceeding 1 Bitcoin — meaning this was not primarily a story of small retail holders losing modest savings. At current market valuations, a single Bitcoin represents a substantial sum, and losses above that threshold suggest the hack disproportionately struck holders sophisticated enough to accumulate meaningful positions but, for whatever reason, exposed to this specific vulnerability. That detail shifts the narrative from opportunistic small-scale phishing to something more targeted or structurally exploitable at scale.
The 87% figure — the share of stolen Bitcoin that has yet to move — is the element that warrants the closest analytical attention. In past major exchange hacks and wallet compromises, stolen funds have historically begun moving within days or weeks as attackers seek to obscure trails through mixers, chain-hopping bridges, or peer-to-peer markets in permissive jurisdictions. The prolonged dormancy of nearly nine-tenths of the Coldcard hack proceeds could mean several things: the attacker or attackers are deliberately waiting for investigative heat to dissipate; the funds are locked in a complex custody or multi-signature arrangement that requires additional steps to liquidate; or law enforcement action has already quietly interdicted some portion of the movement infrastructure the thieves intended to use.
It is also worth considering the possibility that blockchain analytics firms — whose on-chain surveillance capabilities have grown substantially in sophistication — have already flagged these addresses across major exchanges and over-the-counter desks, effectively rendering the Bitcoin difficult to convert to fiat without triggering immediate identification. If that is the case, the 87% dormancy rate may reflect a practical trap as much as a strategic choice. Stolen Bitcoin that cannot be spent without triggering an alarm is, in a functional sense, frozen — a form of informal asset seizure enforced by the private sector rather than a court order.
For the 221 documented victims, however, that frozen status offers cold comfort. Their Bitcoin is not returned simply because it is unmoved. The gap between "unmoved" and "recovered" remains vast, and there is no established mechanism in the Bitcoin protocol or in most legal jurisdictions that would automatically restore funds to original owners even if the attacker's identity were conclusively established. Victims face a laborious process of filing reports, coordinating with law enforcement agencies that have uneven levels of blockchain forensics expertise, and hoping that the eventual movement of funds — whenever it comes — triggers an intercept rather than a successful laundering event.
The Coldcard hack also arrives at a moment when hardware wallet manufacturers are under increasing pressure to prove that their products can withstand not just direct physical attacks but the more sophisticated supply chain, firmware, and social engineering vectors that have evolved alongside the maturing crypto theft ecosystem. Galaxy Research's decision to publish this tally is itself significant: institutional-grade research infrastructure being applied to a retail hardware wallet compromise suggests that the incident has crossed a threshold of scale that demands systematic documentation rather than anecdotal victim reporting alone.
What this means in practical terms is a stress test for the self-custody thesis at a scale rarely seen. Hardware wallets remain among the most defensible options available to individual Bitcoin holders, but the Coldcard incident is a reminder that no custody solution operates in isolation from the human, operational, and supply chain layers surrounding it. With 1,789 BTC on the ledger and 87% still sitting in place — watched, flagged, and yet unclaimed by their rightful owners — the next movement of these coins will be among the most closely monitored transactions on the Bitcoin blockchain. For victims, investigators, and anyone who holds significant value in self-custody, the waiting continues.
Written by the editorial team — independent journalism powered by Bitcoin News.