Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy

Among Galaxy's confirmed waves and footprints, none shows activity after August 6. That doesn't mean the method stopped working. It means the easy targets are gone.

What the chains show

A 2021 firmware update quietly rerouted Coldcard's seed generation off its hardware random-number chip and onto a software stand-in, collapsing key strength from 128 bits to as low as 40. Attackers could rebuild seeds from a device's serial number and clock state, then sweep the coins without resorting to phishing or malware techniques and even without physical access to the actual devices.

Galaxy's breakdown puts the largest proven wave—Wave 1—at 1,082.65 BTC pulled from 1,195 addresses in the opening minutes. That was roughly $70.5M worth of Bitcoin stolen at the time.

Footprint E, the biggest single owner-confirmed cluster, took 209.94 BTC (roughly $13.3M) across 2,148 addresses; Wave 3 took 208.24 BTC (near $13.0M) from 1,912. Across three proven waves and 41 smaller footprints, the firm charts more than 5,200 drained addresses. As of block 962,304 (data Aug. 13), 1,499.27 BTC (nearly $93.9M) sat unspent in attackers’ hands.

Of the thin slice Galaxy can trace to a final endpoint—174.97 BTC—most went into coinjoin privacy rounds, with small amounts reaching KuCoin and Jump Crypto.

Galaxy has spoken to more than 190 victims directly to attribute losses. "The abatement in attack waves is likely because vulnerable users have migrated or most funds have already been drained," it wrote. The company repeats its advice: "If you still hold funds on a single-signature Coldcard wallet, you are advised to move your funds to new addresses."

The episode has already pushed roughly $15 billion in Bitcoin to safer custody and drawn a warning from Ledger that wallet security has to adapt to AI-assisted discovery. Hardware-firm peers have also flagged a phishing surge riding the panic.

Galaxy still carries a candidate fourth wave—638.5 BTC it hasn't confirmed—that would lift the toll to 2,417 BTC, above $151.3 million by today’s prices.