According to CoinMeta, Wu said that based on the feature analysis shared by engineers and researchers from Block, it was found that within 41 minutes from 01:10 to 01:51 on July 30th at UTC, a total of 1,196 addresses had their funds emptied in one go, involving 1,082.65 BTC (approximately 70.2 million US dollars). This incident occurred about 30 hours before Coinkite publicly disclosed the Coldcard MK3 vulnerability. The study found that all transfers used a fixed fee of 30 sat / vb and no change was given back, indicating that the attackers may have used automated tools to transfer funds from wallets for which they possessed private keys in bulk. The stolen funds were then quickly consolidated into four addresses, and no further transfers have occurred since then.