According to CoinMeta, the Coldcard attackers hold 1159 BTC. Although most of the Bitcoin stolen through the Coldcard wallet vulnerability has not been moved, investigators on the chain have discovered that another attacker has begun attempting to transfer small amounts of funds through mixers. Galaxy Research indicates that the largest known theft related to the Coldcard vulnerability involved 1159 BTC. These funds are distributed across seven addresses associated with the attackers and have not changed since the initial transfers. The Coldcard RNG vulnerability cluster received 1159.42 BTC (about 72.71 million US dollars) from 870 exploited addresses. The attackers transferred 0.06 BTC (about 3,780 US dollars) to a new address, while 1159.35 BTC (about 72.7 million US dollars) is still distributed across the eight original attacker addresses. Investigators have not yet detected any transfers from these seven addresses to exchanges, mixers, or other commonly used services.