Key Highlights
- Galaxy Research estimates that more than 1,778 BTC, worth approximately $112 million, has been stolen in the Coldcard exploit.
- No confirmed high-confidence attacker activity has been identified after August 6, although the final loss figure could still rise.
- The attacks began at least as early as July 30, with attackers recreating vulnerable Coldcard-generated seeds and sweeping funds on-chain.
Galaxy Research, the analytical and market intelligence arm of Galaxy, reported that total bitcoin stolen in the Coldcard exploit has exceeded 1,778 BTC, valued at approximately $112 million, with the final figure expected to be higher. The firm stated that among confirmed high-confidence waves and footprints of attacker activity, none occurred after August 6.
In an X post on Friday, Galaxy mentioned attackers began executing the exploit at least as early as the morning of July 30, 2026. They systematically recreated Coldcard-generated seeds and swept funds onchain.
Footprint E identified as the largest attacker
Galaxy Research tracked three major waves and more than 30 smaller footprints. Footprint E was identified as the largest and involved a sophisticated attacker. In addition to the three waves, the firm identified at least 33 additional attacker footprints with assistance from victim reports.
Galaxy Research Head of firmware research, Alex Thorn, said it has spoken directly with more than 190 victims. These reports helped attribute losses and confirm footprints, but none indicated confirmed attacker activity after August 6.
The firm noted that the reduction in attack waves is likely because vulnerable users have migrated funds or most available balances have already been drained. It advised that users still holding funds in a single-signature Coldcard wallet move those funds to new addresses.
Multiple attackers active
Galaxy Research stated with high confidence that multiple attackers were active in the threat environment exploiting the Coldcard vulnerability. It could not confirm whether any of the waves or footprints belonged to the same or different actors.
Of the at least 1,778 BTC stolen, 1,531 BTC remains in attacker-controlled addresses and has not been moved. Approximately 246 BTC has been transferred by attackers after the theft. Of that amount, 65 percent flowed into CoinJoin transactions, and 35 percent continued to move on-chain, in some cases through peelchains. A small portion has been traced in part to deposits into exchanges or bridges.
Galaxy Research provided lists of attacker addresses to crypto exchanges, compliance and investigative firms, and law enforcement agencies. The firm continues to accept victim reports and supply tracing information.
March 2021 update causes recent vulnerability
A firmware bug introduced in a March 2021 update caused affected Coldcard devices to generate recovery seeds with insufficient randomness. Newer models produced roughly 72 bits of entropy instead of the expected 128 bits. Older Mk2 and Mk3 units generated even weaker seeds.
As a result, private keys could be reconstructed offline without physical access to the device. Attackers precomputed these weak seeds and began transferring funds in coordinated waves starting July 30. The activity has involved multiple independent actors.
In an earlier report, Galaxy Research confirmed that 1,719 bitcoin, valued at approximately $111 million, had been stolen from Coldcard hardware wallet users. At that time the firm stated that additional coins remained under review and that total losses were likely to exceed $130 million. Confirmation in both reports has relied on victim reports and multiple corroborating details.
Responding to the incident, Coldcard has made fixed firmware available for every supported COLDCARD model. The firm claims that the fix corrects future seed generation, and it does not repair an existing seed created on affected firmware.
CryptoQuant report claims 1,432 BTC stolen
On August 14, CryptoQuant reported 1,432 BTC stolen in the Coldcard exploit, with 1,367 BTC untouched across 311 addresses (top 5 holding 83%) and only 65 BTC mixed.
Galaxy Research estimated over 1,778 BTC (~$112M) taken, 1,531 BTC still held by attackers, and no high-confidence activity after August 6. However, the two Aug 14 analyses diverge on total losses and fund movement.
Also Read: Cathie Wood’s ARK Invest Buys Securitize, Solana ETF as Palantir & Shopify Sales Continue
