Coldcard Wallet Hack Losses Could Reach $130 Million, Research Firm Warns

Losses tied to a security flaw in Coldcard hardware wallets may climb to roughly 2,000 BTC, or about $130 million, according to Galaxy research . The team identified 1,596 bitcoin stolen from 7,300 addresses across three confirmed attack waves, along with 14 smaller related incidents.

The vulnerability affects seeds generated on several Coldcard firmware versions, prompting the manufacturer to release emergency updates and destroy remaining vulnerable inventory still in stock.

Fourth Wave Still Under Investigation

The issue first surfaced in late July, appearing to involve an automated sweep that may have used AI assistance. Researchers now suspect a fourth wave of attacks that hasn’t yet been fully confirmed through victim reports. If included, this wave would push total losses to roughly 2,055 BTC. Analysts hold moderate-to-high confidence that this latest wave traces back largely to a single attacker, though they’re still gathering victim confirmation.

Most Stolen Funds Remain Untouched

The research firm noted that 90% of stolen coins haven’t moved, with all coins from the first three waves still sitting untouched. The team has been sharing confirmed attacker and victim addresses with law enforcement, exchanges and cybersecurity investigators. The attack remains active, and affected users are being urged to move funds to secure addresses and generate new seeds on safe devices.