Coldcard Bitcoin Exploit Tops $112 Million as Attack Activity Slows
The wave of Bitcoin theft linked to a Coldcard wallet vulnerability appears to be losing momentum, but the damage continues to mount.
Galaxy Research estimates that attackers have now stolen at least 1,778 BTC, worth roughly $112 million at current prices. The research firm said it has very high confidence in the figure, based on confirmed thefts that can be directly attributed to the exploit.
The attacks began on July 30, with criminals systematically recreating seeds generated by vulnerable Coldcard devices and then sweeping the Bitcoin from affected wallets. Unlike conventional wallet attacks, the method did not require victims to click malicious links, install malware or hand over their devices.
The vulnerability traces back to a 2021 firmware change that replaced Coldcard's hardware-based random number generation with a software-based alternative. Galaxy said the change dramatically reduced the effective strength of the generated seeds, in some cases from 128 bits to as little as 40 bits.
That weakness allowed attackers to reconstruct wallet seeds using information including a device's serial number and clock state.
Most Stolen Bitcoin Remains Untouched
The first attack wave remains the largest confirmed incident. Galaxy estimates that 1,082.65 BTC was taken from 1,195 addresses during Wave 1, representing about $70.5 million in Bitcoin at the time.
Another major cluster, identified as Footprint E, accounted for 209.94 BTC spread across 2,148 addresses. A third confirmed wave resulted in the theft of another 208.24 BTC from 1,912 addresses.
Across the confirmed waves and dozens of smaller activity clusters, more than 5,200 addresses have been drained.
Yet most of the stolen Bitcoin has not moved.
Galaxy estimates that approximately 1,531 BTC remains in attacker-controlled addresses. Around 246 BTC has been moved since the thefts, with a significant portion sent through CoinJoin transactions designed to make blockchain tracing more difficult.
Of the relatively small amount that researchers have been able to trace to apparent final destinations, around 174.97 BTC has been identified. Most of that amount entered CoinJoin transactions, while smaller portions reached exchanges including KuCoin and crypto trading firm Jump Crypto.
Attack Waves Have Gone Quiet
Galaxy has not identified any confirmed high-confidence attack activity after August 6.
That does not necessarily mean the vulnerability has stopped being exploitable. Instead, researchers believe the slowdown could indicate that many vulnerable wallets have already been emptied or that owners have moved their Bitcoin to safer addresses.
Galaxy has interviewed more than 190 victims while investigating and attributing losses.
The firm continues to advise anyone still holding Bitcoin in a single-signature Coldcard wallet to move the funds to newly generated addresses.
The incident has also triggered a much broader security response. Around $15 billion worth of Bitcoin has reportedly been moved into safer custody as users reassess their exposure to vulnerable wallets. Other hardware wallet companies have also warned about phishing attempts targeting users worried about the Coldcard incident.
A Fourth Wave Could Change the Numbers
Despite the slowdown, the final loss figure remains uncertain.
Galaxy is tracking a potential fourth attack wave involving an estimated 638.5 BTC that has not yet been conclusively attributed. If confirmed, that would bring the total stolen amount to approximately 2,417 BTC, worth more than $151 million at current prices.
For now, the confirmed figure stands above $112 million. But with stolen coins still sitting in attacker-controlled wallets and additional victims continuing to come forward, the Coldcard incident may not have reached its final chapter.