A investigation by Block and Galaxy Research indicates that the FBI may have identified the attackers involved in the first and largest wave of the July Coldcard hack, during which 1,082.65 BTC were stolen.
Block analysts traced on-chain fund withdrawals to a paid account with a major blockchain data provider, whose internal logs matched the attack pattern with “exceptional accuracy.” The information has already been passed on to the relevant authorities.
In all waves of the attack, confirmed and estimated losses exceeded 1,800 BTC (~$118 million) from more than 5,000 addresses. The coins from the first wave remain untouched in the attacker’s wallet.
The insider attack theory involving the company’s own team is considered unlikely—its founders are publicly working to address the issue rather than disappearing with the funds.