CHAINALYSIS: ATTACKER TARGETED LARGEST COLDCARD WALLETS FIRST, BLOCK SAYS INVESTIGATION TRACED SWEEPER’S WORKFLOW Chainalysis says analysis of the $38M+ Coldcard exploit shows the attacker deliberately targeted the highest-value wallets first, including one holding $1.8 million, suggesting victims were profiled before the sweep began. Roughly $30 million was stolen within the first 10 minutes before about 500 wallets were drained over 25 minutes. Block’s Clay Garrett said investigators also confirmed the attacker used a paid account with a well-known blockchain services provider to query victim addresses during the operation. The provider’s internal logs matched the timing and sequence of requests, but Block said it found no evidence the company knowingly assisted the theft. Relevant information has been shared with authorities.