I originally thought that after stealing the $114.7 million worth of crypto, the first thing to do would be to run. Turns out, when they checked, 87% of it is still lying in place.
According to Alex Thorn of Galaxy Research, in this case involving the Coldcard hardware wallet, a total of about 1,789.28 BTC were stolen, spanning 8,865 addresses. At the value when stolen, that amounts to roughly $114.7 million. Of that, 1,561 coins—87.3%—are still in addresses controlled by the attackers and have not moved.
What’s even stranger is that none of the coins taken in the first three waves were touched at all. Only later did some of the activity start involving CoinJoin and stripping chains for obfuscation.
This is beyond me. If they wanted to cash out, they should have moved it early; if they planned to hold long-term, why would someone start mixing it later? It feels like two groups of operators with completely different habits.
So what is this 87% waiting for? The data doesn’t give the answer. I shrug.
According to Alex Thorn of Galaxy Research, in this case involving the Coldcard hardware wallet, a total of about 1,789.28 BTC were stolen, spanning 8,865 addresses. At the value when stolen, that amounts to roughly $114.7 million. Of that, 1,561 coins—87.3%—are still in addresses controlled by the attackers and have not moved.
What’s even stranger is that none of the coins taken in the first three waves were touched at all. Only later did some of the activity start involving CoinJoin and stripping chains for obfuscation.
This is beyond me. If they wanted to cash out, they should have moved it early; if they planned to hold long-term, why would someone start mixing it later? It feels like two groups of operators with completely different habits.
So what is this 87% waiting for? The data doesn’t give the answer. I shrug.