How the stolen Coldcard Bitcoin is moving

A firmware bug let anyone who noticed guess the keys to thousands of Coldcard wallets. At least fifteen separate attackers did. As of 4 August 2026, about 1,596 BTC had been swept out of roughly 7,300 addresses in four waves over five days.

I built an interactive map of where it went, because the answer is not what I expected. Mostly, it went nowhere.

Most hack graphics are a tangle of exchanges, mixers and peel chains. This one is a river that flows straight into a wall. Roughly nine coins in every ten have not moved since the day they were taken. The largest hoard, 1,159 BTC, sits unspent across seven addresses. Around 600 attacker addresses now sit on a list held by US federal law enforcement, the exchanges and the compliance firms, so the big piles are in plain sight and effectively frozen by the watching.

The smaller thefts are a different story. Those are already moving, through peel chains, cross-chain services and offshore casinos. It is the size of a pile that makes it unspendable, not the ledger.

Stealing it took forty-one minutes. Spending it is the hard part.

The diagram is built for people who do not read block explorers, and it prints cleanly if you want it on paper. Figures are Galaxy Research’s, last checked 5 August 2026. This is a live incident, so treat them as a snapshot rather than a final count.

Project page: https://nader.io/projects/coldcard-money-map