Galaxy Research, the analytics arm of crypto investment firm Galaxy Digital, has identified 1,196 addresses associated with the recent Coldcard wallet breach that resulted in the loss of 1,082.65 Bitcoin, with a value of approximately $70.2 million at the time of the transactions.
On-chain analysis reveals attack patterns
Investigators at Galaxy Research tracked the movement of the stolen Bitcoin between 1:10 AM and 1:51 AM UTC on July 30, analyzing blockchain activity across blocks 960,183 to 960,191. These transactions occurred roughly 30 hours before Coldcard released its initial security warning to users.
Rob Hamilton, CEO and co-founder of AnchorWatch, provided an earlier estimate based on preliminary analysis, suggesting that 594.48 Bitcoin—valued near $38 million—were transferred through 500 transactions within just three blocks.
Subsequent research by the Galaxy team uncovered a distinct transaction pattern among the compromised addresses, including uniform transaction fees of 30 satoshis per virtual byte and transactions that lacked change outputs. This fingerprint allowed researchers to identify the coordinated nature of the initial attack on-chain.
“The initial attack activity is identifiable on-chain through this pattern, but future attacks targeting Coldcard-generated addresses may not follow the same fingerprint,” Galaxy Research stated.
While the clarity of these transaction patterns has aided investigators, experts note that similar vulnerabilities may be exploited differently in the future, potentially making detection more challenging.
Manufacturer responds with hotfix
Rodolfo Novak, co-founder of Coinkite, acknowledged the security lapse in a post on X. Novak said the company takes responsibility for the firmware flaw and is actively working to determine the full scope of the breach.
Novak reported that Coinkite has released a hotfix removing the software fallback path responsible for the vulnerability. He emphasized, however, that updating the firmware alone does not safeguard seeds originally generated on affected versions. Users who created their wallet seeds on the vulnerable firmware are urged to transfer their assets to a newly generated seed as a precaution.
Novak advised that users move funds to a new seed if their wallets were created using a compromised firmware version, highlighting that simply applying the hotfix is insufficient for complete safety.
This incident has refocused attention on best practices for cold wallet security and firm response protocols. Analysts recommend that hardware wallet owners carefully follow manufacturer guidance and monitor for updates to mitigate risks of future vulnerabilities.
Industry shifts toward proactive security and transparency
The Coldcard breach follows a broader trend in the cryptocurrency ecosystem, in which both wallet providers and security researchers stress the need for rapid detection and full transparency during security incidents. Enhanced on-chain monitoring and open communications are becoming standards to better protect user assets and boost market confidence.
As part of the evolving landscape, platforms such as 1stepSwap are breaking down longstanding barriers between traditional finance and crypto by offering blockchain-based access to real-world assets. By integrating assets like shares in major U.S. companies or commodities such as gold and silver directly into user wallets, and automatically securing the best market price at any moment, such innovations aim to offer more resilient diversification options for crypto participants.
