Stolen Bitcoin from the extensive Coldcard wallet exploit has climbed above 1,778 BTC, now valued at more than $112 million, according to a Thursday report from Galaxy Research. The New York-based analytics firm has been tracking each development of the exploit since its discovery and now suspects that the full scale may reach over 2,400 BTC if current trends persist.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLConfirmed losses and timeline
Galaxy Research said the breach, which surfaced on July 30, 2026, involved attackers methodically recreating wallet seeds generated by Coldcard devices and transferring the digital assets to addresses under their control. The last confirmed signs of attacker activity appeared on August 6, after three major attack waves and over 30 smaller traces, but Galaxy believes that the pause does not indicate the attack method has been fully neutralized—only that easily compromised wallets may have already been emptied.
The firm reported that of the total 1,778 BTC stolen so far, 1,531 BTC currently remains at attacker-controlled addresses and unmoved since the theft, while approximately 246 BTC has been shifted by attackers post-theft, with most of those funds routed through Coinjoin transactions to obscure their trail.
Attackers began exploiting the vulnerability at least since the early hours of July 30, 2026, by systematically recreating seeds generated by Coldcard devices and sweeping Bitcoin from affected wallets, Galaxy Research stated.
How the exploit worked
According to Galaxy, a firmware change in 2021 redirected Coldcard’s seed generation functionality away from its secure hardware random-number generator to a software-based substitute. This weakened the seed’s entropy from 128 bits to potentially as low as 40 bits, allowing attackers to reconstruct wallet seeds using serial numbers and clock states alone, without leveraging phishing or malware and without physical access to the devices.
Mini dictionary: Coldcard is a hardware wallet designed for secure Bitcoin storage, developed by Coinkite. The device is known for advanced security features, but this exploit occurred due to a firmware vulnerability, not a hardware flaw.
The heaviest confirmed phase of the attack, known as Wave 1, saw 1,082.65 BTC stolen from 1,195 addresses within minutes, valued at roughly $70.5 million at the time. Another significant breach, labeled as Footprint E, resulted in 209.94 BTC taken from 2,148 addresses, while Wave 3 involved 208.24 BTC lost from 1,912 wallets.
| Wave/Footprint | BTC Stolen | Addresses Affected | Estimated Value |
|---|---|---|---|
| Wave 1 | 1,082.65 | 1,195 | $70.5M |
| Footprint E | 209.94 | 2,148 | $13.3M |
| Wave 3 | 208.24 | 1,912 | $13.0M |
In total, Galaxy Research has recorded more than 5,200 addresses drained in three major attack waves and 41 smaller incidents. Data from August 13 (block 962,304) indicates nearly $93.9 million in stolen Bitcoin still resides in the wallets under the attackers’ control.
Warnings and recommendations
Galaxy Research has directly contacted more than 190 victims to validate incidents and continues to advise anyone still storing Bitcoin in single-signature Coldcard wallets to move their assets to fresh wallets generated on uncompromised devices.
The abatement in attack waves likely reflects that vulnerable users have already relocated their assets or that most susceptible wallets have been compromised. Galaxy Research urged: If you still hold funds in a single-signature Coldcard wallet, move your funds to new addresses.
So far, the incident has prompted Bitcoin holders to collectively transfer around $15 billion in assets to more secure locations. Notably, Ledger, a major hardware wallet company, issued a warning to the crypto industry that wallet security protocols need to increase their resilience as attacks assisted by artificial intelligence become more sophisticated. Other security providers have also observed a rise in phishing attempts amid the heightened anxiety.
Galaxy still lists a potential but unconfirmed fourth wave, involving an estimated 638.5 BTC, which if verified, would raise the overall amount stolen to 2,417 BTC and lift the total value to approximately $151.3 million at current market rates.
