Not everyone agrees the stolen BTC are trapped, with some pointing to mixers, Lightning, and privacy tools as possible escape routes.
Well over $100 million worth of Bitcoin (BTC) has now been stolen through the ongoing Coldcard wallet exploit, said Galaxy Research, but market commentator Joe Consorti has argued that the attacker may struggle to spend much of that haul since every BTC is being tracked on the public blockchain.
Instead of focusing on the size of the theft alone, Consorti said the incident also shows an often-overlooked feature of the OG crypto: while private keys can be compromised, the movement of stolen units remains visible to law enforcement, exchanges, and blockchain analysts.
Transparency Leaves Stolen Bitcoin Under Watch
In a post on X, Consorti wrote:
“The thief who stole $100 million in BTC is going to have a hard time spending most of it. Every coin is sitting in plain sight, tracked by Galaxy, the FBI, and thousands of others.”
He added that Bitcoin “might be the worst money for crime ever invented.” In a video accompanying the post, the analyst pointed out that the exploit was not a failure of the Bitcoin network itself but of wallet software that generated weak seed phrases on affected Coldcard firmware released after March 2021.
He also noted that users who followed recommended self-custody practices still became victims because the underlying randomness used to generate wallet seeds had been weakened.
Galaxy Research has so far identified 1,596 BTC stolen across roughly 7,300 addresses in three confirmed attack waves. If suspected but unconfirmed activity is included, then the losses could reach 2,055 BTC, worth north of $130 million.
According to the firm, about 90% of the stolen Bitcoin has not been moved, while all the coins from the first three confirmed waves are still in wallets controlled by the attacker. It also said that it had shared all the confirmed attacker addresses with US law enforcement agencies, as well as crypto exchanges and blockchain investigation companies.
You may also like:
Despite the scale of the theft and the headlines it has since generated, BTC was trading near $64,000 at the time of writing, up 2% in the last 24 hours, a point Consorti cited as evidence that the market has largely separated the security failure from the Bitcoin protocol itself.
The first confirmed theft emerged on July 31, when 594.5 BTC was swept from about 500 addresses across four blocks. Coinkite, the company behind the Coldcard device, said that the affected seeds carry around 72 bits of entropy instead of the 128 bits they are supposed to have, making them guessable with enough computing power.
The company has since patched newer firmware but cannot fix seeds already generated on vulnerable devices and has advised users of its Mk3, Mk4, Mk5, and Q devices to move their funds to unaffected hardware.
Debate Continues Over Whether the Loot Can Be Laundered
Crypto commentator Shagun had the same idea as Consorti, arguing that blockchain analytics, compliance checks, and operational mistakes would make moving such a large amount of stolen Bitcoin far more difficult than stealing it. Instead, they advised the attacker to return the funds in exchange for a negotiated security bounty.
However, not everyone agreed that the thief would be unable to cash out, suggesting that they could cover their track using privacy tools such as mixers, privacy-focused coins, Taproot transactions, and the Lightning Network.
