Galaxy Research has raised its estimate of losses from the Coldcard hardware-wallet exploit to 1,789.28 (Bitcoin) BTC across 8,865 addresses, worth about $114.7 million when the bitcoin was stolen, according to Alex Thorn, the firm’s head of firmwide research.
The updated figure, posted by Thorn in an X post on Monday, represents an increase from Galaxy’s previous estimate of 1,778.84 BTC stolen from more than 8,600 addresses. At current prices cited by Thorn, the same Bitcoin is worth about $138.8 million.
The latest data also shows that the affected wallets were predominantly long-dormant addresses. The median dormancy period was 3.2 years, while the average was 3.6 years, according to Thorn.
Victim reports account for less than half of the identified loss
Galaxy has reported 221 victim reports, with combined losses totaling 790.72 BTC, or about 44.2% of the overall amount identified so far. Among those reported cases, the median loss was 1.04272 BTC, and the average was 3.57792 BTC. The median dormancy period was 3.25 years, compared with an average of 2.99 years.
The difference between reported losses and the wider on-chain tally reflects Galaxy’s use of blockchain analysis to identify additional affected addresses beyond users who have directly contacted the firm.
Galaxy previously said it had been in direct contact with 190 victims and had confirmed 1,778.84 BTC stolen from more than 8,600 addresses.
Medium-confidence cases could push losses higher
The 1,789.28 BTC figure does not include all addresses that Galaxy has identified as potentially connected to the exploit. Thorn said that including medium-confidence losses would bring the total to about 1,824 BTC, or roughly $140 million based on prices at the time of the thefts.
That figure remains an estimate rather than a confirmed loss total. Galaxy has previously distinguished between high-confidence thefts and additional footprints that it could not conclusively attribute to the Coldcard exploit.
Exploit traced to Coldcard seed generation
The thefts began on July 30 and stem from a flaw in Coldcard’s seed-generation process. Galaxy’s research found that a firmware change introduced in March 2021 caused affected devices to fall back to an inadequate source of entropy when generating wallet seeds.
That reduced the effective randomness of some affected seeds, allowing attackers to generate candidate keys and identify corresponding Bitcoin addresses without obtaining physical access to the devices. Galaxy said the vulnerability affected certain Coldcard-generated wallets rather than Bitcoin’s underlying cryptography or consensus rules.
The attack unfolded through multiple waves and additional attacker footprints. Galaxy said it had identified at least 33 additional footprints beyond the major waves but could not establish whether all of them belonged to the same attacker.
Most of the stolen Bitcoin remains unmoved
The majority of the identified stolen funds have not moved since the attacks. Galaxy previously reported that about 1,531 BTC of the 1,778 BTC then confirmed stolen remained in attacker-controlled addresses. Roughly 246 BTC had moved, with about 65% of that amount flowing into CoinJoin transactions and the remainder moving through other on-chain transactions, including peel chains.
Galaxy has shared lists of addresses associated with the thefts with exchanges, compliance companies and law-enforcement agencies in an effort to identify or freeze funds if they reach centralized intermediaries.
No confirmed new attack activity after Aug 6
Galaxy said it had not identified confirmed attacker activity after Aug. 6, although victims continued to come forward and provide information that helped researchers attribute additional losses.
The firm cautioned that the apparent slowdown could reflect the migration of vulnerable funds or the fact that many exposed balances had already been drained.
The incident remains one of the largest known compromises involving a hardware wallet. TRM Labs separately estimated the losses at roughly 1,816 BTC in its own recent analysis, underscoring that the total remains subject to further attribution and reconciliation as investigators identify additional affected addresses.
Also Read: ZachXBT Links M1llionz to $667,000 French Robbery Laundering
