Approximately $118 Million in BTC Remains at Attacker Address; Identity of First-Wave Coldcard Attacker May Already Be in Law Enforcement's Hands

Odaily News – Investigative progress has been made regarding the large-scale Coldcard hardware wallet theft that occurred in July 2026. Approximately 1,082.65 BTC from the first wave of attacks, valued at around $118 million, remains stored at the attacker's address. The investigation revealed that the attacker used a paid account with a blockchain data services provider, whose internal logs closely match the pattern of the theft. Relevant leads have been forwarded to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first-wave attacker may already be known to authorities. Subsequent waves of attacks resulted in the theft of approximately 2,000 BTC in total, with the second wave involving around 76 BTC. The operational pattern was similar to the first wave, suggesting the possibility of the same perpetrator.