Galaxy Research reports Coldcard wallet theft losses may exceed $150 million, with over 1,778 BTC confirmed stolen.
Coldcard Wallet Exploits Lead to Significant Bitcoin Losses
Recent findings from Galaxy Research indicate that the thefts associated with the Coldcard wallet have resulted in confirmed losses exceeding 1,778 BTC, valued at approximately $112 million. This figure may rise further, with a potential fourth wave of attacks that could increase total losses to 2,417 BTC, or over $150 million.
Though no new incidents have been reported since August 6, following three major waves of attacks and over 30 smaller ones, experts caution that the situation remains precarious. Galaxy Research has been in contact with over 190 victims and strongly advises holders of single-signature Coldcards to move their assets to new addresses to mitigate risks.
Details of the Exploit
The exploitation of Coldcard wallets began on July 30, 2026, when attackers gained the ability to recreate Coldcard-generated seeds, enabling them to drain funds without the need for phishing or malware. This vulnerability stemmed from a firmware update that weakened the seed generation process.
Galaxy's analysis revealed that the first wave of attacks resulted in the theft of 1,082.65 BTC, amounting to around $70.5 million. The most significant individual theft involved 209.94 BTC from a single owner, while the third wave accounted for losses of 208.24 BTC. Across all incidents, more than 5,200 addresses have been compromised.
Current Status of Stolen Funds
As of mid-August, the majority of the stolen BTC remains untouched, with 1,531 BTC still held in the attackers' wallets. While 246 BTC has been moved, most of it has been funneled into Coinjoin transactions for privacy. Galaxy continues to track the situation and has noted a decline in attack activity, likely due to victims securing their funds more effectively.
The ramifications of these thefts have prompted a shift of around $15 billion in Bitcoin to more secure storage solutions, alongside warnings from hardware wallet manufacturers about increased phishing attempts and the need for enhanced security measures.
Galaxy is actively monitoring a potential fourth wave of attacks, which, if confirmed, could significantly elevate the total losses attributed to the Coldcard exploits.
