Chainalysis and Block said the attackers appeared to pre-profile high-value wallets and used a paid blockchain data account before draining about 500 wallets within 25 minutes.
Hackers behind the Coldcard incident appear to have profiled victims before the theft began, targeting the highest-value wallets first, including one holding $1.8 million, Chainalysis said in its analysis of the more than $38 million exploit. About $30 million was stolen in the first 10 minutes, and roughly 500 wallets were drained within 25 minutes, underscoring the speed and selectivity of the attack. Block's Clay Garrett said investigators also found the attackers queried victim addresses through a paid account at a well-known blockchain service provider, with the provider's internal logs matching the timing and sequence of requests. Block said it found no evidence the company knowingly assisted the theft and that the information has been shared with authorities.