Approximately $30 million was stolen in the first 10 minutes; attackers exploited the Coldcard vulnerability to target the highest-value wallets.

According to Bitcoin News, Chainalysis reports that analysis of the Coldcard exploit, which involved over $38 million, shows attackers deliberately targeted the highest-value wallets first, including one holding $1.8 million, indicating the victims were profiled before the asset transfer began. Approximately $30 million was stolen in the first 10 minutes, followed by about 500 wallets being emptied within 25 minutes. Clay Garrett of Block.com stated that investigators also confirmed the attackers used a paid account from a well-known blockchain service provider to query the victims' addresses during the operation. The provider's internal logs matched the time and sequence of requests, but Block.com stated they found no evidence of the company knowingly assisting the theft. This information has been shared with authorities.