Galaxy Research has confirmed that losses from the ongoing Coldcard hardware wallet exploit have surpassed $100 million, with 1,596 Bitcoin stolen across approximately 7,300 addresses. The theft, traced to three confirmed attack waves, highlights a firmware vulnerability in devices manufactured after March 2021. A suspected fourth wave could push total losses to about 2,055 BTC, valued near $130 million, though Galaxy has not yet verified those cases.
Engineers at Block first detected Wave 1, and subsequent victim reports helped confirm Waves 2 and 3. Most victims appeared in only one wave, but some addresses were compromised twice. Fourteen smaller incidents were also identified, possibly tied to different attackers exploiting the same weakness.
The stolen Bitcoin remains largely unmoved—90% has stayed on-chain, and every coin from the three confirmed waves remains in attacker-controlled wallets. Galaxy Research has shared all confirmed attacker and victim addresses with U.S. federal law enforcement, crypto exchanges, compliance firms, and cyber investigators. Meanwhile, Joe Consorti, a market commentator, noted that the transparency of Bitcoin’s blockchain makes spending such a massive haul extremely difficult, as the funds are visible to “Galaxy, the FBI, and thousands of others.”
Coinkite, the maker of Coldcard, stated that affected seeds have only 72 bits of entropy instead of the required 128 bits, making them guessable with enough computing power. The company has patched newer firmware but cannot fix previously generated seeds. It advised users of Mk3, Mk4, Mk5, and Q devices to move their funds to unaffected hardware.
Despite the scale of the theft, Bitcoin’s price remained stable, trading near $64,000 at the time of reporting, suggesting the market distinguishes between a wallet software failure and the Bitcoin protocol itself.
