I've seen posts that the exploit targeted larger accounts first. But I don't know how large wallets that used a Coldcard would be distinguished from other wallets that didn't.