Galaxy Research confirmed 1,596 Bitcoin stolen across three coordinated waves of attacks targeting Coldcard hardware wallets. That's roughly $100 million gone. A fourth suspected wave could push the total to 2,055 BTC, worth nearly $130 million, but investigators are still waiting for victim confirmation before counting those coins as definite losses.
The attacks exploited a flaw in Coldcard's seed-generation process. Galaxy's researchers identified about 7,300 compromised addresses plus another 14 smaller incidents tied to the vulnerability. According to the firm's analysis, one attacker appears to have orchestrated much of the fourth wave, giving analysts medium-high confidence that pattern holds despite the unconfirmed victim reports.
Stolen coins sitting still
Around 90 percent of the stolen Bitcoin hasn't moved since the thefts. Galaxy and other investigators have already shared confirmed attacker and victim addresses with U.S. law enforcement, major exchanges, and cyber investigation groups. The research firm says the latest estimate represents confirmed losses only, narrowing down earlier blockchain analysis that suggested roughly 1,815.75 BTC moved across all four observed waves.
Coldcard users affected by the vulnerability have been urged to generate entirely new wallet seeds and shift their funds immediately. The hardware wallet maker has issued patches, but the damage from the seed-generation flaw spans months of undetected exploitation.
This article is for informational purposes and does not constitute financial advice. Always conduct your own research before making investment or security decisions.
