Galaxy Research Estimates Coldcard Hardware Wallet Losses Could Reach 2,000 BTC

Scope of the Coldcard Vulnerability

Galaxy Research stated on social media platform X on Monday that it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, plus 14 smaller security incidents. These incidents are tied to an issue affecting seeds generated on Coinkite’s Coldcard Mk3, Mk4, Mk5, and Coldcard Q firmware versions.

The issue first came to wider attention on July 30, when multiple exploit reports surfaced. According to Galaxy, the activity appears to have been an automated, programmatic sweep, potentially with large language model (LLM) assistance. Coinkite has since released emergency firmware updates for all affected Coldcard models and reported that it has destroyed remaining vulnerable inventory.

Galaxy noted that, as of its latest assessment, 90% of stolen coins have not moved and that 100% of coins involved in Waves 1, 2, and 3 remain unmoved. The firm emphasized the importance of continuing to identify attacker addresses, particularly as new opportunistic attackers may emerge.

Possible Fourth Wave and Ongoing Response

Galaxy Research indicated that it has identified a potential fourth wave of attacks but has not yet received specific victim confirmation for this wave. The firm stated that including this suspected Wave 4 would bring total estimated losses to 2,055 BTC, equivalent to approximately $130 million. Galaxy described its confidence level as “medium-high” that Wave 4 is “substantially comprised of” one attacker, while noting the lack of sufficient victim confirmation.

Galaxy Head of Firmwide Research Alex Thorn previously highlighted the possible existence of this fourth wave, pointing out that its transaction pattern matches earlier attack waves. Galaxy also reported that it is cooperating with U.S. federal law enforcement agencies, crypto exchanges, and cyber investigation groups by providing confirmed attacker and victim addresses.

The firm stated that the attack is ongoing and urged Coldcard users to migrate funds to a secure address and generate a new seed on a secure device.

FAQ

What hardware wallets are affected by this issue?
Galaxy Research linked the attacks to seeds generated on Coinkite’s Coldcard Mk3, Mk4, Mk5, and Coldcard Q firmware versions.

How much bitcoin has been confirmed stolen so far?
Galaxy Research has identified 1,596 BTC stolen across three confirmed waves of attacks and 14 smaller incidents.

What is the potential total loss if the fourth wave is confirmed?
Including the suspected fourth wave, Galaxy Research estimates total losses could reach 2,055 BTC, or about $130 million.

Have the stolen coins been moved?
Galaxy reported that 90% of stolen coins have not moved, and that 100% of coins associated with Waves 1, 2, and 3 remain unmoved.