New analysis of Bitcoin theft reports reveals that stolen funds overwhelmingly came from long-dormant wallets, with victims reporting a median loss of over one coin.

Data posted on X from Galaxy Research’s Alex Thorn looked at 250 victim reports and found the typical stolen coin had sat untouched for 3.5 years, and a striking 88% of pilfered funds were at least a year old. 

By address, losses ranged from a median of 0.014 Bitcoin to a mean of 0.212 Bitcoin, while individual victims reported a median loss of 1.022 Bitcoin and an average of 4.04 Bitcoin — with one unlucky holder losing as much as 58.97 coins. 

Hackers started by taking over $35 million in Bitcoin from wallets last week Thursday. Coinkite, which makes Coldcard, said that a firmware bug in Coldcard Mk3 devices — starting with version 4.0.1 in March 2021 — caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases. 

The theft continued throughout the weekend while Coinkite and other Bitcoiners urged Coldcard users to immediately move their funds.

Galaxy Research said Friday that a total of $111 million has been confirmed stolen but the number could be much higher as it continues its research. 

“We have many more coins we are vetting for confirmation — we think total losses likely exceed $130 million,” the firm wrote on X. 

Since the attack, cautious investors have been moving their coins to other storage solutions — including exchanges.

Coinkite said in a statement this week that the bug in its software “silently went unnoticed” and “its potential impact grew with every release” of its products. 

Days after the first hack, the company urged investors to update their software or move their funds off the popular hardware wallet.