Funds accounting

Galaxy Research reported 1,196 addresses and 1,082.65 BTC from 01:10:20 to 01:51:26 UTC on 30 July, across blocks 960,183 to 960,191. It attributed the wider set to one operator using the transaction pattern identified by Block. Galaxy also published a derivation-path count of 1,183 BIP-84, 7 BIP-49 and 6 BIP-44 addresses. R6 This remains Galaxy's figure for the 30 July waves. Its top line has moved twice since, on 1 August and again on 3 August; both revisions are recorded next.

Galaxy described the repeated target as a "hardcoded 30.0 sat/vB" fee rate with no change output. Galaxy Research, X, 31 Jul 2026

Galaxy does not publish the underlying transaction list or its address-counting method, so the 1,196-address set cannot be rechecked address by address from the post alone. On-chain output types do not independently reveal wallet derivation paths, so the BIP-84, BIP-49 and BIP-44 counts remain Galaxy's reported classification.

This register preserves the estimate as each source stated it, newest first. "Copy held" means the archive has a captured version that can be checked for later changes. The press rows mostly restate the primary accountings rather than add independent analysis.

The US$38 million and US$70 million figures primarily reflect different BTC sets, 594.48 BTC versus about 1,082.6 BTC, as well as each publisher's BTC/USD conversion time. Galaxy's approximately US$88.6m belongs to the three-wave scope of 1 August, and its US$100M and US$130m statements of 3 August to the wider confirmed and suspected sets. Tracker rows carry the figure read from the capture named in the row; those sites publish live totals that may have moved since it was taken.

The held diff record shows how quickly the moving rows moved. coldcard-watch's headline ran 1,082.57 to 1,128.47 to 1,158.85 to 1,359.18 to 1,366.58 BTC between 1 and 2 August. coldcard-hack-tracker's total ran 1,128.56 to 1,368.58 to 1,433.49 to 1,822.42 to 1,876.83 to 1,923.81 BTC between 1 and 4 August, the largest steps being its five-wave rebuild, its adoption of the wave-4 claim and its addition of a Taproot wave. Kelbie's own stated totals ran 1,128.49 BTC on 1 August, 1,367 BTC on 2 August and 1,433.13 BTC on 3 August. Each step is a classified captured difference, preserved under the changes record. V13 Then both trails went quiet for different reasons. coldcard-watch stood at 1,366.58 BTC for three days, not because the tracker held still but because the name stopped resolving through this collector's DNS on 4 August; when polling resumed on 7 August the first capture read 1,405.07 BTC across 4,925 addresses, and carried the rename and the three-way view filter with it. coldcard-hack-tracker's headline has not moved since 4 August, while the holdings, movement feed and still-held share underneath it have changed on most polls since. V14

On 3 August 2026 the @intangiblecoins account published a pattern-matched fourth-wave claim while transactions were still pending. The opening post states 218 transactions, 462 victim addresses, 216 fresh destinations and 388.92748828 BTC across blocks 960,778 to 960,792. Its two linked Pastebins hold the confirmed-transaction address set and a pending set stated as another 104 sweeps, 199 victim addresses and 70.16757699 BTC, all signalling replace-by-fee. The original three-post thread, both lists and the account's two later corrections are held. R15

The first correction, posted at 01:37 UTC on 3 August, removed six of 216 destination addresses because they had years of transaction history before block 960,183 on 30 July 2026, which the author judged unlikely for attacker addresses. Of the remaining addresses, 206 were stated to have been freshly created to receive the sweeps. R16

The second correction, posted at 03:22 UTC and credited to Nunchuk, states that the circulated set erroneously included multisig addresses, while waves 1 to 3 contain none. It gives wave 4 as circulated at 857 addresses and 486.11 BTC, a multisig discount of 89 addresses and 20.58 BTC, and a surviving core of 709 addresses and 448.73 BTC. The author stresses that wave 4 rests on pattern matching, that no direct victim has confirmed a wave-4 loss yet, and that the word "likely" is used out of caution. R17

Later on 3 August, at 22:51 UTC, Galaxy published its own assessment of the wave: medium-high confidence that wave 4 is substantially comprised of an attacker, a total of 2,055 BTC if it is included, and no promotion into the top-line numbers because no victim has confirmed inclusion. coldcard-hack-tracker carries the wave at 443.34 BTC across 703 addresses, and states its own derivation for that figure: it starts from 448.73 BTC, which it attributes to Galaxy rather than to @intangiblecoins, and drops six further destinations that already had prior on-chain history, a cut of 5.39 BTC. It also reads Galaxy's approximately 2,055 BTC ceiling as the 1,596 BTC high-confidence figure plus that 448.73 BTC candidate. Galaxy's own thread publishes neither 448.73 BTC nor any itemised wave-4 component, so the reconciliation is the tracker's reading of Galaxy rather than Galaxy's own. R18

The stated figures do not reconcile from the correction posts alone: 857 addresses minus the 89-address multisig discount gives 768, not the stated 709, and 486.11 BTC minus 20.58 BTC gives 465.53 BTC, not the stated 448.73 BTC. D19 The post does not explain the difference. As with other conflicting figures on this page, the numbers are preserved as the source states them rather than silently adjusted.

Wave 4 sits outside Galaxy's confirmed total and outside the 30 July sets above. Whether the wave-4 set belongs to the same incident is recorded as an open question below.

The timing statements are not all measurements of the same transaction set. Where a source gives a date without a timezone, it cannot be converted to a UTC date without an additional assumption.

Galaxy's 31 July flow-of-funds mapping names four final consolidation holdings for the attributed 30 July sets. The original first collector for the 500-transaction set sent 562.01962301 BTC to the first address and retained 32.45055543 BTC in the fourth, per the same mapping. R21

Galaxy stated on 3 August that 100 percent of coins in waves 1 to 3 have not moved and 90 percent of stolen coins overall have not moved, a statement that covers these four holdings. All four are still recorded as held in the newest coldcard-hack-tracker capture. Movement has since been recorded inside the wider set that statement covered, though not in these four addresses: on 7 August the tracker recorded the wave 2 collector bc1qmd5m5k…9n8jp6 emptied, 30.18476329 BTC leaving in a 93-input consolidation confirmed at block 961,368, and qualified its own Galaxy source note to say that waves 1 to 3 coins were then still unmoved. Its moved total ran from 6.81368697 BTC in the capture of 4 Aug 03:05 UTC to 118.60759628 BTC in the capture of 7 Aug 13:20 UTC, and its still-held share from 99.5 to 92.0 percent. The rest of the movement it records sits outside the four holdings, in the suspected wave-4 park, the later Taproot wave and the smaller incidents: deposits it attributes to Bullish.com, Coinbase Prime Custody, KuCoin and Binance, and an ETH leg it says ran through THORChain into Tornado Cash, credited on the page to @osint_based. R23 No captured source reports a seizure, recovery or freeze for any of these funds as of 15 August 2026. This is an absence of reported evidence, not a prediction about future movement.

Two community trackers, coldcard-watch and coldcard-hack-tracker, monitor attributed addresses and publish changing totals, and a third, coldcard.rip, keeps a ten-wave ledger with a movement record. Their captured figures use differing treatments of the later waves and later inbound deposits, so they should not be used as a fixed incident total without those qualifications.

Galaxy cautioned that future transactions involving affected keys would not need to share this transaction pattern. R24 The observed fee and output pattern characterises the set attributed by Block and Galaxy; it is not a necessary property of exploiting the firmware flaw.

Nothing in the held captures records an exchange freeze, a flagging commitment or any other custodial action against the four consolidation addresses as of 15 August 2026, and no captured source names an exchange or service that has undertaken to stop or mark deposits from them. The tracker record does show deposits attributed to the later wave-4 park reaching Bullish.com, Coinbase Prime Custody and KuCoin, and deposits attributed to the later Taproot wave reaching Binance, with no freeze or seizure of any of those reported either. That is an absence in what has been published and collected here, not a finding that no such step has been taken. U28

One collection route is open on the analysis side. Galaxy's own disclaimer records that some of the addresses behind its on-chain topographies were received from victim reports on X, and that its analysis "should not be considered to be complete or definitive". Its identified set is therefore open to further reported attacker and victim addresses rather than closed; its published top line moved twice between 31 July and 3 August, both times upward. R29 This archive does not collect or publish victim addresses, and nothing here should be read as advice to send an address to a third party.

The timing and transaction pattern are consistent with the public incident, but the blockchain does not identify the hardware or software that generated a private key. TFTC explicitly separates its reproduced chain event from the unproven claim that every transaction resulted from this firmware flaw. Galaxy's 3 August thread states that the 14 smaller footprints it identified could be many different attackers individually exploiting the now-known vulnerability. U30

• How many people were hit. Source-address counts and people are not equivalent. One person or entity can control multiple addresses, and an address can have multiple controllers. The number of distinct affected owners is unknown; 73 individual victims had contacted Galaxy's @intangiblecoins for tracing help as of 3 August, a reported lower bound on affected owners, not a count. R31
• How many operators are behind the confirmed set. Galaxy's 3 August thread confirms waves 1 to 3 through victim reports but states that the 14 smaller footprints could be many different attackers individually exploiting the now-known vulnerability. Block's fingerprint match for the 695 earlier transactions remains reported rather than independently confirmed. On 4 August, Galaxy's Alex Thorn estimated at least 15 distinct attackers based on continuing victim reports and newly labelled activity. R32 The newer number is therefore recorded as an estimate, not a resolved operator count. U33
• What is in Galaxy's wider confirmed set. Galaxy's 3 August total spans three confirmed waves plus 14 smaller incidents across about 7,300 addresses. The underlying transaction and address lists are not published, and Galaxy states it has not tested whether the addresses it identifies were generated with low entropy. R34
• Whether the reported 31 July cluster is related. Kevin Kelbie reported 1,216 transactions moving 45.9 BTC after Block's scan end. Seven of eight stated markers match, while the replace-by-fee behaviour differs. Kelbie's own tracker now integrates the cluster as wave 960345 of its ten-wave incident set, citing a named claimant, a Chainabuse report and Galaxy Research. It enters no total on this page. R35 U36
• Whether the circulated fourth wave is part of the same incident. The corrected wave-4 set rests on pattern matching. Galaxy suspects it is real with medium-high confidence, and neither Galaxy nor its author reports direct victim confirmation as of 15 August 2026. The coldcard-hack-tracker capture of 14 Aug 2026, 00:24 UTC still labels the wave "pattern-match only (no victim report yet)". Its stated figures, corrections and unreconciled arithmetic are recorded above; it enters no total on this page. U37
• Whether the consolidated funds will move further, and where. Movement has been reported outside the four-address cluster, from the suspected wave-4 park and the later Taproot wave, and on 7 August from a wave 2 collector inside the set Galaxy described as unmoved. No forward statement is possible; the four holdings above are Galaxy's as published on 31 July, their held status is read from the tracker capture named beside them, and Galaxy's unmoved-coins statement is fixed to 3 August.
• Any recovery, seizure or insurance payout. None has been reported in any captured source as of 15 August 2026. A 3 August report of white-hat drains underway, relayed by Bitcoin News from a community post, is unconfirmed and does not name recovered amounts. In the 6 August capture of a Reddit thread carrying the same claim, a commenter writes that they have seen only rumours, nothing concrete. R38