Summary
- Galaxy Research reports that the confirmed losses from the Coldcard exploit exceed 1,778 BTC (approximately $112 million), with a potential fourth wave increasing the total to 2,417 BTC.
- No confirmed attacks have been recorded since August 6, following three major waves and over 30 smaller incidents.
- Galaxy has engaged with over 190 victims and continues to advise holders of single-signature Coldcards to transfer their assets to new addresses.
The incidents of Bitcoin theft linked to the Coldcard wallet are experiencing a decline, yet the total amount of stolen BTC is still rising, indicating that the situation may not be fully resolved.
According to the latest findings from Galaxy Research, the Coldcard seed-recreation exploit has resulted in the loss of more than 1,778 BTC, valued at around $112 million, and this figure is expected to increase.
Galaxy expresses "very high confidence" in their assessment, which accounts for confirmed thefts attributed to owners since the exploit began on July 30, as detailed in their ongoing updates on X.
"The attacks have been ongoing since the early hours of July 30, 2026, with attackers systematically recreating Coldcard-generated seeds and draining the funds," Galaxy Research noted.
Despite the absence of new activity since August 6, this does not imply that the exploit is ineffective; rather, it suggests that the more accessible targets have already been compromised.
The majority of the stolen funds have not been moved since the theft. Of the at least 1,778 BTC taken, 1,531 BTC remains in the attackers' wallets, with approximately 246 BTC having been moved, of which 65% was funneled into Coinjoin transactions… pic.twitter.com/OHjJkr1x6D
— Galaxy Research (@glxyresearch) August 14, 2026
Insights from the Blockchain
A firmware update in 2021 inadvertently shifted Coldcard's seed generation from its hardware random-number chip to a software alternative, reducing the key strength from 128 bits to as low as 40 bits. This vulnerability allowed attackers to reconstruct seeds using a device's serial number and clock state, enabling them to access the funds without needing phishing or malware tactics or physical access to the devices.
According to Galaxy's analysis, the first wave of attacks, labeled Wave 1, accounted for 1,082.65 BTC taken from 1,195 addresses within minutes of the attack's initiation, equating to about $70.5 million at that time.
The largest confirmed theft from a single owner, known as Footprint E, involved 209.94 BTC (approximately $13.3 million) across 2,148 addresses, while Wave 3 resulted in the loss of 208.24 BTC (around $13.0 million) from 1,912 addresses. In total, the firm has documented over 5,200 drained addresses across three major waves and 41 smaller incidents. As of block 962,304 (data from August 13), 1,499.27 BTC (nearly $93.9 million) remained unspent in the hands of the attackers.
Among the confirmed waves and footprints of attacker activity, there have been no incidents recorded after August 6. While additional victims continue to report to Galaxy Research (over 190 have been contacted directly), helping to attribute losses and confirm further footprints, no new thefts have been identified… pic.twitter.com/8jEdFdJEog
— Galaxy Research (@glxyresearch) August 14, 2026
From the traceable portion of the stolen funds—174.97 BTC—most have been funneled into Coinjoin privacy rounds, with smaller amounts reaching exchanges like KuCoin and Jump Crypto.
Galaxy has interacted with more than 190 victims to help attribute losses accurately. They noted that the decrease in attack waves likely results from victims migrating to safer options or the majority of funds already being drained. Their advice remains clear: "If you still possess funds in a single-signature Coldcard wallet, it is recommended that you transfer your assets to new addresses."
This incident has led to approximately $15 billion in Bitcoin being moved to more secure storage solutions and has prompted warnings from Ledger regarding the need for improved wallet security in light of AI-assisted vulnerabilities. Other hardware wallet manufacturers have also highlighted a surge in phishing attempts amid this crisis.
Galaxy is still monitoring a potential fourth wave involving 638.5 BTC that remains unconfirmed, which could raise the total loss to 2,417 BTC, exceeding $151.3 million at current market values.