Galaxy Research links 1,789 Bitcoin to the Coldcard hack, with 1,561 BTC still unspent in attacker-controlled addresses.