Galaxy: Coldcard Hack Stole 1,789 BTC, 87% Still Unmoved

The standout figure here is not the loss itself but the dormancy: most of the stolen bitcoin has not moved, which suggests the attacker is either consolidating control, waiting out chain-surveillance attention, or holding keys it cannot yet safely use. That matters for anyone relying on hardware wallets as a custody backstop, since the episode points to a failure mode around the device rather than an exchange or counterparty. Whether the remaining balance eventually moves, and how it is split, is the open question worth watching.