According to CoinMeta, and as reported by Bitcoin Magazine, progress has been made in the investigation of the coin theft incident from Coldcard hardware wallets in July 2026. Approximately 1,082.65 BTC (about $118 million) remain in the attackers' accounts from the first wave of attacks. The investigation revealed that the attackers used a paid account from a blockchain data service provider, and the internal logs matched the pattern of the coin thefts closely. Relevant clues have been handed over to law enforcement authorities. Galaxy Research analyst Alex Thorn indicated that the identities of the attackers from the first wave may now be in the hands of law enforcement. A total of about 2,000 BTC were stolen in the subsequent attacks, with the second wave involving approximately 76 BTC. The mode of operation for the second wave is similar to that of the first wave, suggesting that it may have been carried out by the same individuals.