Key facts
- Coldcard Bitcoin thefts have slowed, but total losses may exceed $150 million.
- Galaxy Research estimates confirmed stolen Bitcoin at over 1,778 BTC ($112 million).
- A potential fourth wave could increase the total to 2,417 BTC.
- The exploit exploits a firmware update that weakened seed generation security.
- No attacker activity has been detected since August 6.
Stolen Bitcoin losses from the massive Coldcard wallet exploit have begun to slow, but the total amount of BTC swiped continues to climb, with the worst potentially not yet over. Galaxy Research estimates the exploit has drained more than 1,778 BTC, approximately $112 million, and the final figure could be higher.
Attackers have been executing this exploit since at least July 30, 2026, systematically recreating Coldcard-generated seeds and sweeping funds on-chain. Among the confirmed waves and footprints of attacker activity, none shows activity after August 6, suggesting that easy targets may have been exhausted or vulnerable users have migrated funds.
The exploit stems from a 2021 firmware update that rerouted Coldcard's seed generation from its hardware random-number chip to a software stand-in, reducing key strength from 128 bits to as low as 40 bits. This allowed attackers to rebuild seeds from a device's serial number and clock state, enabling them to sweep coins without physical access or resorting to phishing or malware.
Galaxy's breakdown indicates the largest proven wave, Wave 1, pulled 1,082.65 BTC from 1,195 addresses. Footprint E took 209.94 BTC across 2,148 addresses, and Wave 3 took 208.24 BTC from 1,912 addresses. Across three proven waves and 41 smaller footprints, the firm charts more than 5,200 drained addresses.
Of the stolen funds, a significant portion remains in attacker-controlled addresses. Approximately 1,531 BTC of the 1,778 BTC stolen is still unmoved, while about 246 BTC has been moved, with 65% flowing into Coinjoin transactions. A small amount reached exchanges like KuCoin and Jump Crypto.
Galaxy has spoken directly to over 190 victims to attribute losses. The company reiterates its advice for single-signature Coldcard holders to move their funds to new addresses. The episode has prompted an estimated $15 billion in Bitcoin to be moved to safer custody and led to warnings about wallet security adapting to AI-assisted discovery, along with a surge in phishing attempts.