Stolen Bitcoin linked to the Coldcard wallet vulnerability started moving through a mixer. The largest known still controls approximately 1,159 BTC across seven addresses, but investigators are monitoring hundreds of wallets connected to the wider exploit. Attacker Leaves 1,159 BTC UnmovedGalaxy Research said the largest theft connected to the vulnerability involved 1,159 BTC. Bitcoin transactions cannot be stopped at the protocol level simply because an address has been flagged. The mixing activity also seems separate from the seven-address cluster holding 1,159 BTC.