Galaxy Research, the research arm of Galaxy Digital, has identified 1,196 addresses linked to the Coldcard wallet incident that lost a combined 1,082.65 Bitcoin, worth roughly $70.2 million at the time of the transactions.
Tracing the movements
Galaxy Research traced the Bitcoin flows between 1:10 AM and 1:51 AM UTC on July 30, spanning blocks 960,183 to 960,191.
The activity occurred about 30 hours before Coldcard published its first security advisory, according to a Friday post on X.
The new figure significantly raises earlier estimates.
AnchorWatch CEO Rob Hamilton initially calculated that 594.48 Bitcoin, worth around $38 million, moved across 500 transactions within a three-block window.
A recognizable on-chain pattern
Galaxy Research said the flagged transactions shared a distinct signature, including identical fees of 30 satoshis per virtual byte and no change outputs.
The firm noted the early attack activity is identifiable through this fingerprint, but cautioned that future attacks against Coldcard-generated addresses may not follow the same pattern.
Coinkite responds
Coinkite co-founder Rodolfo Novak said in a Friday post that the company takes responsibility for the firmware bug and is working to determine the full scope of the issue.
Novak said Coinkite released a hotfix to remove the software fallback path, but warned the update does not protect seeds generated on vulnerable firmware.
He advised affected users to move their funds to a new seed as a precaution.
