It depends entirely on where your share of the money went. There are five possible answers, and they are very different. The chart below shows how much of the stolen total is in each.
Still sitting, fully traceable
1,332.34 BTC · 74.5% · $103.4M
Parked in identified addresses that we and every major tracing firm watch. It cannot be sold through a compliant exchange without being flagged. If law enforcement ever identifies the holder, this portion is seizable — large seizures years after a theft have happened before.
Do: file a police report and an IC3 complaint now, listing your address and the sweep transaction. Seized funds are returned to documented victims.
Reached an exchange
7.46 BTC · 0.4% · $579,229
Deposited at named services — Coinbase, Bullish, KuCoin, Bybit, ChangeNow among them. Exchanges hold identity records and freeze deposits when law enforcement asks. This is the portion with a real recovery path.
Do: name these services and the deposit transactions in your report. The full list is further down this page.
Swapped to Ethereum via THORChain
20.69 BTC · 1.2% · $1.6M
Converted to ether through THORChain, a cross-chain swap protocol with no operator, no accounts and no freeze function. Every swap announces itself on the Bitcoin side with a protocol memo naming the Ethereum address that receives the ether, so we know exactly where it landed and watch that address. Nothing can be frozen on Bitcoin; a recovery path opens only where that ether is eventually deposited. Since then, 660 ETH of it has gone into Tornado Cash, a mixer on Ethereum — that part is realistically gone.
Do: quote the swap transactions and the Ethereum address listed further down. Any exchange that later receives from that address can be asked to freeze.
We cannot say yet
292.40 BTC · 16.3% · $22.7M
Taken in parts of the theft whose destination addresses have never been published by anyone. This is not money we lost track of — it was never tracked. Our address set covers the waves that were documented publicly; the rest of the theft has not been mapped address-by-address, by us or by anybody else.
Do: if the check below says your address is not in our set, your coins are most likely in this slice. Report it anyway — and check back, because we add addresses as they are confirmed.
Through a mixer — realistically gone
136.39 BTC · 7.6% · $10.6M
Run through CoinJoin rounds that blend hundreds of people’s coins. Tracing beyond this point is speculative, and no freeze is possible. Honesty matters more than hope here: this slice is unlikely to come back.
Do: still report it. Amounts entering a mixer remain evidence in the wider case.
Anyone who contacts you offering to recover your bitcoin for a fee is a scammer
No exception. Victims of this exploit are being targeted a second time by fake “recovery agents”. Recovery only happens through law enforcement and the exchanges themselves.
What happened, step by step
Five days of theft, then almost nothing. Every figure below is read from the Bitcoin blockchain.
Prefer the story to the balances? Read the full investigation — the narrative account of how the exploit worked and how the money was moved. Its figures are frozen at 7 August 2026 and cover a narrower address set than this page, which keeps updating.
30 July
The theft starts. In about 40 minutes 1,196 wallets are emptied of 1,082.65 BTC. Most had been sitting untouched for years — the typical victim wallet had not moved in over three years.
Blocks 960,183–960,191 · a single sweep, paying 30 sat/vB
31 July – 3 August
Three more waves follow. By the 3rd the total reaches 1,789.28 BTC across 8,865 wallets — worth about $114.7M at the prices of the day.
Wave totals credited to Galaxy Research
3–4 August
The thieves try the exits. Roughly 7.46 BTC reaches Unnamed high-volume service, ChangeNow, KuCoin, Quidax and other services. That is 0.4% of everything taken — a rounding error against the pile. Another 136.21 BTC goes through CoinJoin mixers instead.
30.18 BTC is shuffled out of one collecting address into a fresh one. It has sat there ever since.
Block 961,368
19 August
1.05 BTC leaves one of the parked addresses and is run through a CoinJoin mixer the next day — the only attempt at covering tracks in weeks, and a trivial sum against what is still sitting still.
Block 963,189 — the last movement out of any watched vault
Today
1,332.34 BTC — about $103.4M — has never been spent. Nothing has reached an exchange for 39 days. The single largest pile, 562.02 BTC ($43.6M), has never been touched at all.
Read from block 966,642
2 August
20.69 BTC is walked through a chain of fresh addresses and swapped to ether through THORChain, a swap protocol with no operator to freeze anything. The ether lands at one Ethereum address, which we now watch alongside the bitcoin.
ETH 0x160a7A4c… ← 20.15 BTC in 26 swaps · holds 0 ETH · ETH 0x8B5b6500… ← 0.30 BTC in 8 swaps · holds 0 ETH · ETH 0x6A08B5B2… ← 0.24 BTC in 2 swaps · holds 0 ETH
Where the stolen bitcoin is now — and what we cannot account for
Follow the ribbons left to right: from the victims, into the thieves’ collection addresses, to where each coin sits today. Widths are proportional to BTC.
The transactions you can actually act on
Every time traced coins landed somewhere a freeze is possible. If you are a victim, these are the transaction IDs to put in your police report and to quote when you contact the exchange. Each links to the block explorer so anyone can verify it independently.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 2.00 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 2.00 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 1.00 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 1.00 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.45 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.27 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.24 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.14 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.09 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.07 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.06 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.06 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.05 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.02 BTC of what finally arrived traces back to this theft.
Amounts change between steps because the thief’s coins are mixed with other people’s money at each hop. Only 0.01 BTC of what finally arrived traces back to this theft.
2 further movements are deliberately not listed here. They reached services too, but the addresses they came from were funded only by wallets that predate the exploit, and the amounts passed through unchanged — the signature of an owner moving their own coins to safety after the news broke, not a thief cashing out. Calling those a cash-out would smear both a victim and an exchange, so we leave them out until they can be resolved.
Converted to ether through THORChain — nothing to freeze on Bitcoin
20.69 BTC of the traced coins was converted to ether through THORChain in 36 swaps, landing at the Ethereum address 0x160a7A4c067B084F03400c6980Ac29F73F6782f6 — which holds 0 ETH as of 2026-09-12 06:37 UTC. Each Bitcoin transaction below carries THORChain's own memo naming that destination, so the link is the protocol's, not our inference. No exchange holds these coins.
On Ethereum since then:649 ETH in 73 transactions to TornadoCash eth0x47CE0C6e…, 5 ETH in 1 transaction to 0x9dD14d97…, 0.48 ETH in 1 transaction to 0x8d0079D0… (0 ETH left, checked 2026-09-12 06:37 UTC). 649 ETH went into Tornado Cash, a mixer on Ethereum, which is the same dead end as a CoinJoin on Bitcoin: realistically gone.
Read the two amounts carefully. A transaction often moves other people’s money in the same batch. We show what the whole transaction moved and how much of it traces back to this theft — only the second number is the thief’s, and claiming the first would be wrong.
Every time the money moved
Newest first. Tiny amounts sent to these addresses are ignored — strangers spam famous wallets with dust, and that is not the thief moving anything.
When
How much
What happened
7 Sep
5 days ago
54.78 BTC
$4.3M
Went into a CoinJoin mixing round, where it was combined with hundreds of other people's coins. The trail cannot be followed past this point.
Paid into a THORChain vault and swapped to ether. The protocol memo on the transaction names the Ethereum address that received it; nothing can be frozen on the Bitcoin side.
Paid into a THORChain vault and swapped to ether. The protocol memo on the transaction names the Ethereum address that received it; nothing can be frozen on the Bitcoin side.
Paid into a THORChain vault and swapped to ether. The protocol memo on the transaction names the Ethereum address that received it; nothing can be frozen on the Bitcoin side.
Every service the traced coins have reached. These are the places where a freeze is possible — if you are a victim, these names belong in your police report.
Which company an address belongs to comes from industry screening data. The behaviour beside each name — transaction counts, lifetime volume, the deposit itself — is measured by us directly from the blockchain, and you can verify every figure through the linked explorer.
Confirmed means an independent source ties the address to this exploit. Attributed means a named entity whose on-chain activity matches that claim. Traced means we reached it from a confirmed address. Venue means a high-volume service the money passed through — the address is not the holder’s own and its balance is not stolen money. Reported means published by other researchers and not yet reproduced by us. Nothing is called attacker-controlled on our word alone.
The victims
8,865 wallets were drained. The typical victim lost 0.0152 BTC (about $1,179), and the typical wallet had been sitting untouched for over three years — long-term savings, not trading money.
The complete list of every wallet we traced is available as a spreadsheet further down, for researchers, exchanges and law enforcement. If you are a victim, you do not need it — check your own address privately below, and treat anyone who contacts you about your loss as a scammer until proven otherwise.
Take the data
Everything on this page as spreadsheets, regenerated on every update. Open directly in Excel. Each file carries its own provenance header and the block it was compiled at.
If you run an exchange or a compliance desk: the attacker file is the one to screen deposits against. Read the classification column first — several rows are exchanges the funds passed through and must not be treated as attacker-controlled.
Check an address
Paste a Bitcoin address to see whether it appears in the victim set we derived on-chain.
Derived independently by walking back from the attacker addresses: 4,718 victim addresses holding 1,479.00 BTC. That accounts for 99.51% of everything our watched addresses took in, but only 53.2% of the addresses Galaxy Research counts — we do not cover the whole theft, and we would rather say so than imply otherwise.
Checked entirely in your browser. The address never leaves this page and nothing is logged.
Never enter a seed phrase, private key, or xpub
This tool accepts a public Bitcoin address and nothing else. Any site asking for your recovery words is stealing from you — including one that looks like this.
