How the stolen Coldcard Bitcoin is moving

A firmware bug let someone guess the keys to thousands of Coldcard wallets. As of 4 August 2026, about 1,596 BTC had been swept out of roughly 7,300 addresses in four waves over five days.

I built an interactive map of where it went, because the answer is not what I expected. It went nowhere.

Most hack graphics are a tangle of exchanges, mixers and peel chains. This one is a river that flows straight into a wall. Roughly nine coins in every ten have not moved since the day they were taken. Not one satoshi has touched a mixer. Nothing has been cashed out. Around 600 attacker addresses now sit on a list held by US federal law enforcement, the exchanges and the compliance firms, so the money is in plain sight and effectively frozen by the watching.

Stealing it took forty-one minutes. Spending it is the hard part.

The diagram is built for people who do not read block explorers, and it prints cleanly if you want it on paper. Figures are Galaxy Research’s. This is a live incident, so treat them as a snapshot rather than a final count.

Project page: https://nader.io/projects/coldcard-money-map