Coldcard Hack Surges Past $100M as Fourth Wave Threatens $130M Total Losses

Woofun AI reports that Galaxy Research, the analytical division of Galaxy Digital, has validated a massive security breach involving Coldcard wallets, confirming losses exceeding $100 million. The incident involves the theft of 1,596 Bitcoin (BTC) from approximately 7,300 addresses, distributed across three distinct major attack waves and 14 smaller incidents.

The scope of the confirmed damage was significantly expanded on Monday, when Galaxy Digital’s research arm stated that 73 victims had directly contacted investigators. These victim reports substantiated the first three major attacks, allowing researchers to identify smaller "footprints" attributed to opportunistic attackers exploiting the vulnerability. This new data supersedes the previous estimate published on Saturday, which had traced only 1,367 BTC across 4,585 addresses, thereby solidifying the scale of the initial three major attacks.

Woofun AI data shows that a suspected fourth wave could elevate total losses to 2,055 BTC, valued at approximately $130 million. Although Galaxy Research excluded this event from the confirmed estimate due to a lack of direct victim confirmation, the group assigned "medium-high" confidence to the attribution of attacker activity. Crucially, 90% of the stolen Bitcoin, including funds from the first three confirmed incidents, has not been moved, with attacker and victim addresses shared with US federal law enforcement, crypto exchanges, and cyber-investigation companies.

The threat level remains ongoing, prompting urgent advisories for Coldcard users. Galaxy warns that uncertain users must migrate their funds to a safe address immediately to prevent further exploitation. This marks a critical escalation in hardware wallet security risks.