- Published on
Galaxy
- Authors
- Name
- DeepHorus
Coldcard bitcoin theft losses have surpassed $100 million, according to Galaxy Research. The incident involves 1,596 Bitcoin stolen from about 7,300 addresses across three confirmed attack waves and 14 smaller incidents. Galaxy Digital's research arm disclosed the figures on Monday, marking a significant escalation from earlier estimates.
The attack targeted Coldcard hardware wallet users. Galaxy researchers identified the three major waves through victim reports, with 73 victims contacting the team. Investigators also found smaller "footprints" that may represent opportunistic attacks exploiting the same vulnerability. A suspected fourth wave could bring total losses to 2,055 BTC, worth around $130 million.
Galaxy excluded the fourth wave from confirmed estimates because victims had not yet verified it. However, researchers expressed "medium-high" confidence that the wave represented attacker activity. The confirmed figures increased from the 1,367 BTC previously traced across 4,585 addresses on Saturday.
Notably, 90% of the stolen Bitcoin remains unmoved, including funds from the first three incidents. This suggests attackers may be waiting or struggling to launder the funds. Galaxy has shared attacker and victim addresses with US federal law enforcement, crypto exchanges, and cyber-investigation firms to aid recovery.
The ongoing attacks raise concerns for Coldcard users. Galaxy warned that additional waves could emerge and urged uncertain users to migrate funds to a safe address immediately. The incident highlights vulnerabilities in hardware wallets, often considered the most secure storage method.
As investigations continue, the crypto community will monitor for further developments. If confirmed, the fourth wave would make this one of the largest hardware wallet thefts on record. Galaxy's findings underscore persistent risks in the crypto ecosystem, even for users relying on physical security devices.
