153 compromised addresses hold 132.95 BTC, researchers still unable to reproduce Coldcard attacker's seed

Odaily News, according to Bitcoin News monitoring, new research released by @PraveenPerera shows that the Coldcard attacker appears to have first identified vulnerable addresses, then sorted them by BTC balance, and began transferring funds in batches starting from the addresses with the highest holdings. The actual transfer software used was relatively crude. One address had 225 spendable UTXOs, and the attacker happened to extract the most recent 200, leaving the earliest 25, including one UTXO worth 0.16 BTC. This is fully consistent with the 200-record limit that a blockchain API investigated by the researchers returns by default, suggesting the attacker may have failed to load the next page of data. The software even spent a 294-satoshi UTXO, reportedly increasing transaction fees by approximately 2,040 satoshis, with the spending amount clearly exceeding the UTXO's own value. Based on this, the study's author believes the tool's builder may have a stronger understanding of account balance systems than of Bitcoin's UTXO model. Although the attacker appears to have obtained victims' full seeds, at least 75 BTC remain in other addresses derived from the same seeds. The biggest mystery at present is that 132.95 BTC still remain across the 153 compromised addresses, and researchers have been unable to reproduce the seeds behind these addresses, so they cannot rule out the possibility that the attacker obtained undisclosed private device data or candidate data.