Coldcard Hack Losses Near $130M as Galaxy Research Identifies 15 Attackers
Galaxy Research says at least 15 separate attackers are exploiting vulnerable Coldcard wallets, with suspected Bitcoin losses climbing to roughly 2,055 BTC, or about $130 million.
Update, October 22, 2026: Coinkite's security advisory confirms that a firmware bug weakened seeds generated on Coldcard Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 firmware before 5.6.0, and Q firmware before 1.5.0Q (Edge releases before 6.6.0X and 6.6.0QX). Updating the firmware does not fix an existing seed. Affected users need to generate a new seed on fixed firmware and move their funds, including any multisig setup that uses an affected key. Follow Coinkite's migration guide. Loss figures in this article are third-party estimates; Coinkite has not published a total.
>
Correction: An earlier version said affected owners had not migrated “more than a week” after disclosure; this article was published five days after it. Unsourced claims about rival wallet makers have been removed.
!Coldcard Wallet Hack Expands as 15 Attackers Push Losses Toward $130M
- Galaxy Research says the Coldcard exploit is now being used by at least 15 different attackers.
- We’re looking at estimated losses of about 2,055 BTC, worth roughly $130 million.
- Verified thefts already top $100 million and involve more than 7,300 affected addresses.
The Coldcard hardware wallet exploit has widened from a handful of coordinated attackers into what Galaxy Research now describes as an open free-for-all. At least 15 separate actors are racing to drain vulnerable wallets before the rest get moved to safety. More in crypto news.
Losses Galaxy rates as high-confidence stand at 1,596 BTC, worth just over $100 million and these were taken from roughly 7,300 addresses across three verified attack waves plus 14 smaller incidents. Add a suspected fourth wave that Galaxy hasn’t fully confirmed, and the total climbs closer to 2,055 BTC, near $130 million.
Coldcard Exploit Expands From One Attack Chain to Multiple Actors
Most hardware wallet breaches trace back to a single group working one exploit chain. This one didn’t stay that way. Galaxy’s Head of Research, Alex Thorn, said the firmware flaw is now being worked by numerous independent actors rather than one coordinated operation. Once the technical details of an exploit like this circulate publicly, anyone with the skill to reproduce it can join in, and that’s exactly what’s happened here.
now NUMEROUS different attackers exploiting the Coldcard vulnerability. we estimate at least 15 different attackers now
>
we continue to receive victim reports and give them info to report to authorities
>
and those reports help us identify new attacks and label attackers
>
— Alex Thorn (@intangiblecoins) August 4, 2026
The bug itself lives in a seed-generation flaw in certain Coldcard firmware versions. Attackers can guess private keys without ever touching the physical device. That undermines the core promise of offline storage in the first place. Coinkite, the manufacturer, has released fixed firmware for every affected model, and has said it destroyed remaining vulnerable inventory, CBC reported.
None of that protects funds already generated on a compromised seed, though. Users still need to generate a brand-new recovery phrase on corrected firmware and move their Bitcoin. Galaxy says a meaningful share of affected owners still hadn’t done that days after the flaw went public.
Why the Coldcard Threat May Continue to Grow
Roughly 90% of the stolen Bitcoin has not moved on-chain, which Galaxy has flagged as both a warning sign and an opportunity. Static coins remain traceable, and the firm continues sharing attacker and victim addresses with law enforcement and exchanges in hopes of intercepting funds before they’re laundered.
🚨LOSSES FROM COLDCARD HACK EXCEED $100M
>
High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.
>
If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).
>
More in the thread below 👇 pic.twitter.com/RAl3ib67qa
>
— Galaxy Research (@glxyresearch) August 3, 2026
For Coldcard users, the operative question isn’t whether the exploit is over. Galaxy has been explicit that it isn’t, and that new opportunistic attackers keep appearing as the vulnerability details continue to circulate across security forums and social media.
Sources:
Coinkite’s Coldcard security advisory