Coldcard Bitcoin Theft Tops $115M as Attack Data Emerges

Bitcoin stolen through the Coldcard hardware-wallet vulnerability is now valued at more than $115 million based on prices at the time of each theft, according to new data published by Galaxy Research.

The updated figure substantially exceeds the roughly $70 million initially associated with a rapid July 30 sweep. Galaxy said it has spoken with more than 200 victims to provide support and gather intelligence about the attackers.

Its analysis divides the thefts into separate waves and examines the age of the compromised coins, attacker wallet fingerprints and transaction styles.

The findings suggest the incident was broader and more methodical than a single 41-minute attack.

New Trending Crypto Wallet Offers

Galaxy Identifies Multiple Attacker Waves and Footprints

Galaxy’s latest charts categorize victim losses according to distinct attacker waves and on-chain footprints. The researchers analyzed when the stolen Bitcoin had last moved, how much was taken from each address and the transaction patterns used to consolidate funds.

This coin-dormancy analysis is particularly important because affected wallets included long-inactive holdings. Some owners may have interpreted years without movement as evidence that their cold-storage setup remained secure.

Coldcard losses have exceeded $115M (based on the price when coins were stolen)

Galaxy Research has spoken with 200+ victims to support them and gather intelligence on the attackers

This thread contains additional charts and info 👇 pic.twitter.com/H2K141mugF

— Galaxy Research (@glxyresearch) August 16, 2026

Instead, the attackers appear to have targeted seeds generated with insufficient randomness, allowing private keys to be reconstructed without gaining physical possession of a device.

Galaxy also mapped the number of compromised addresses by the quarter in which their coins last moved. Separately, it compared the value stolen with coin dormancy and plotted victim-reported losses across the identified waves.

Although Galaxy has not publicly attributed every wave to the same person or group, differences in wallet fingerprints and transaction construction may help investigators distinguish between operators.

July Sweep Was Only Part of the $115M Loss

The most visible attack occurred on July 30, when researchers traced 1,082.65 BTC from 1,196 wallets during a 41-minute period between 1:10 a.m. and 1:51 a.m. UTC.

The attackers broadcast transactions across six Bitcoin blocks, although three contained no related transfers. This pattern indicated that the attackers were submitting transactions in coordinated batches rather than draining wallets continuously.

Coldcard BTC stolen — BTC stolen by coin dormancy (month that coins last moved onchain prior to theft. | Credit: Galaxy Research

Earlier reporting valued that sweep at approximately $70 million.

Galaxy’s new total includes additional victim-reported thefts and attack waves, bringing cumulative losses above $115 million when each loss is valued at the Bitcoin price prevailing at the time.

The vulnerability reportedly originated in a March 2021 software change that diverted seed creation from the intended hardware random-number generator to a predictable fallback.

Coinkite estimated that affected Mk3 devices offered roughly 40 bits of effective security, while later affected models provided about 72 bits.

Victims Urged to Register Losses and Replace Seeds

Coinkite has issued corrected firmware for Coldcard Mk3, Mk4, Mk5 and Q devices. However, new firmware cannot strengthen a seed created with inadequate randomness.

Affected users must create a completely new seed, verify the replacement wallet with a test transaction and transfer any remaining Bitcoin. According to the manufacturer, at least 50 private dice rolls protected a seed from this specific flaw.

Galaxy has urged victims to document their losses with law-enforcement authorities and seek professional tracing assistance.

Attacker wallet fingerprint and transaction style by wave and footprint. | Credit: Galaxy Research

Formally establishing ownership could improve recovery prospects if stolen funds eventually reach a centralized exchange or another intermediary capable of freezing assets.

The case also challenges the assumption that hardware wallets automatically eliminate custody risk.

Cold storage can protect keys from online attacks. But firmware flaws, weak entropy and unsafe recovery procedures remain potential failure points.

With the vulnerability present for roughly five years, researchers warn that additional exposed wallets may still contain funds. The $115 million estimate may therefore rise as more victims come forward and investigators connect further transactions to the exploit.

Top Picks for Bitcoin

$115M in Bitcoin Stolen: New Coldcard Data Reveals How the Attackers Operated

Galaxy Identifies Multiple Attacker Waves and Footprints

July Sweep Was Only Part of the $115M Loss

Victims Urged to Register Losses and Replace Seeds

Related