The scale of the Coldcard hardware wallet security incident continues to grow, with confirmed losses now exceeding $100 million, according to the latest investigation by Galaxy Research. The new findings indicate that attackers have stolen 1,596 Bitcoin (BTC) from approximately 7,300 wallet addresses across multiple coordinated attacks, making it one of the largest hardware wallet exploits in the cryptocurrency industry’s history.
Researchers also believe an additional wave of attacks may still be unfolding, potentially pushing total losses well beyond current estimates.
Three Major Attack Waves Confirmed
Galaxy Research reported that investigators have now verified three major attack waves, along with 14 smaller exploit incidents, all believed to be linked to the recently disclosed vulnerability affecting certain Coldcard hardware wallets.
The confirmation comes after dozens of affected users contacted Galaxy’s research team, allowing investigators to validate blockchain transaction patterns and identify additional compromised addresses.
According to the report, the coordinated nature of the attacks suggests that threat actors systematically exploited wallets generated using vulnerable firmware versions.
Suspected Fourth Wave Could Push Losses to $130 Million
While confirmed losses currently stand at 1,596 BTC, Galaxy researchers believe the total damage may ultimately be significantly higher.
The firm has identified evidence of a suspected fourth attack wave involving an estimated 2,055 BTC, valued at approximately $130 million.
However, Galaxy has not yet included those figures in its official confirmed total because investigators are still awaiting verification from users believed to have been affected.
Despite the lack of direct victim confirmation, researchers said they have medium-to-high confidence that the blockchain activity represents additional attacker operations rather than ordinary transactions.
Majority of Stolen Bitcoin Remains Unmoved
One of the most notable findings from the investigation is that approximately 90% of the stolen Bitcoin has not yet been moved.
The relatively limited movement of funds suggests attackers may be deliberately delaying attempts to launder or liquidate the stolen assets while monitoring law enforcement activity.
Blockchain investigators continue tracking the compromised funds, making it possible to monitor future transfers as they occur.
Law Enforcement and Exchanges Notified
Galaxy Research confirmed that blockchain intelligence gathered during the investigation has already been shared with multiple organizations.
Information regarding attacker wallets and victim addresses has been provided to:
- U.S. federal law enforcement agencies
- Cryptocurrency exchanges
- Blockchain analytics firms
- Cybersecurity investigation companies
The coordinated effort aims to improve the chances of identifying suspicious transfers and potentially preventing attackers from converting stolen Bitcoin into fiat currency or other digital assets.
Investigation Continues to Expand
The latest report significantly increases Galaxy’s previous estimate released only days earlier.
Earlier findings had identified approximately 1,367 BTC stolen from around 4,600 compromised addresses.
Continued forensic analysis and additional victim reports have since revealed a substantially larger attack footprint, indicating that the vulnerability affected far more wallets than initially believed.
Researchers believe further compromised addresses could still be identified as additional victims come forward.
Coldcard Users Urged to Act Immediately
With attacks still believed to be ongoing, Galaxy Research is urging anyone using potentially affected Coldcard devices to take immediate precautionary measures.
Users uncertain whether their wallets were generated using vulnerable firmware versions are advised to:
- Update to the latest firmware release.
- Generate a new wallet using secure firmware.
- Transfer funds to a newly generated address immediately.
- Verify wallet security before moving large balances.
Security experts emphasize that delaying migration could leave vulnerable wallets exposed to additional attacks if compromised seed phrases are eventually discovered by malicious actors.
One of Crypto’s Largest Hardware Wallet Incidents
The Coldcard exploit has become one of the most significant hardware wallet security incidents ever recorded.
Unlike exchange hacks, which typically compromise centralized platforms, this incident highlights the risks associated with flaws in wallet firmware and cryptographic key generation.
The attack has intensified calls across the cryptocurrency industry for stronger firmware auditing, independent security testing, and improved verification standards for hardware wallets designed to protect long-term digital asset holdings.
As investigators continue tracing stolen funds and monitoring potential new attack waves, the full financial impact of the exploit may not yet be known.
