Galaxy Research tied the Coldcard exploit to 1,596 stolen Bitcoin across three confirmed attack waves on Monday. The haul came from roughly 7,300 addresses, valued at close to $130 million based on current Bitcoin prices.
A suspected fourth wave could push the total past 2,055 BTC if investigators confirm it. Galaxy researcher Alex Thorn spotted the additional theft pattern on August 3, flagging 448.7 coins stolen from 709 probable victim addresses. The firm held back from adding those to the official count.
The research team also uncovered 14 smaller security incidents linked to the same seed-generation flaw, expanding the known scope of the vulnerability. Galaxy lacks enough verification from wallet owners to formally tally the suspected fourth wave. Blockchain data suggests one attacker likely orchestrated a big chunk of that activity.
On-chain analysis has real limitations here. The evidence doesn't always confirm every suspected victim, and it can't prove a single person committed each theft tied to the exploit. Galaxy's investigators keep updating their address map as wallet owners submit fresh data and other participants share their findings.
The bug affects Coldcard seeds generated through specific methods. Victims continue surfacing weeks after the initial discovery, making the final damage tally uncertain. Each new report pushes the research team to recalibrate their estimates.
This article is informational only and does not constitute financial advice. Always conduct your own research before making investment decisions.