Galaxy Confirms $100M+ Coldcard Bitcoin Theft, Attacks Ongoing
Galaxy Research reports confirmed losses exceeding $100 million from Coldcard wallets, with 1,596 BTC stolen across three attack waves and 14 smaller incidents. A fourth wave may push losses to $130 million. Users are urged to migrate funds immediately as attacks continue.
Quick Take
Galaxy Research confirms over $100M in Bitcoin stolen from Coldcard wallets.
1,596 BTC taken from 7,300 addresses in three major attack waves.
Ongoing attacks prompt urgent warning for users to migrate funds.
Possible fourth wave could increase losses to $130 million.
Market Impact Analysis
BearishA major ongoing hack targeting a popular hardware wallet erodes trust in security solutions and could cause investors to sell or avoid the market.
Speculation Analysis
Key Takeaways
- Over $100 million in Bitcoin has been stolen from Coldcard wallets, with attacks still active and users urged to migrate funds immediately.
- 1,596 BTC were taken from 7,300 addresses across three major attack waves and 14 smaller incidents.
- A suspected fourth wave could push total losses to $130 million, though this remains unconfirmed by victims.
- 90% of the stolen Bitcoin remains unmoved, and addresses have been shared with US law enforcement and exchanges.
What Happened
Galaxy Research has confirmed a staggering breach of Coldcard hardware wallets, with over $100 million in Bitcoin stolen across multiple attack waves. The theft, first reported earlier this week, has now been traced to 1,596 BTC drained from approximately 7,300 addresses. Three major waves have been identified, accompanied by 14 smaller incidents that researchers believe may be copycat attacks exploiting the same vulnerability. A fourth wave is suspected, potentially raising the total haul to 2,055 BTC—worth $130 million—though Galaxy has not yet confirmed this with victims. With attacks ongoing, Galaxy issued an urgent advisory for Coldcard users to migrate assets to secure addresses without delay.
The Numbers
The scale of the heist is unprecedented for a hardware wallet exploit. Galaxy’s updated figures show 1,596 BTC stolen, a sharp rise from the 1,367 BTC initially traced across 4,585 addresses. Over 7,300 unique addresses were compromised in three major attack waves and 14 smaller incidents. Notably, 90% of the stolen Bitcoin remains unmoved, suggesting either a calculated holding strategy or difficulty in laundering such a large sum. If the unconfirmed fourth wave is included, losses could reach $130 million. The research team has shared all attacker and victim addresses with US federal authorities, crypto exchanges, and cyber-investigation firms.
Why It Happened
A critical vulnerability in Coldcard wallets was exploited, though exact technical details remain undisclosed to prevent copycat attacks. The three major waves indicate a coordinated effort, while the 14 smaller incidents suggest opportunistic attackers jumped on the exposed flaw. The ongoing nature of the theft points to either a persistent vulnerability or delayed user response to warnings. The incident highlights the risks of even widely trusted cold storage solutions when underlying flaws go unpatched. Market confidence in hardware wallets has taken a hit, reinforcing the adage that no security measure is foolproof.
Broader Impact
Beyond the immediate financial loss, this breach erodes trust in cold storage—traditionally considered the gold standard for crypto security. Investors may rethink their custody strategies, potentially shifting assets to multi-signature solutions or regulated custodians. The attack could also invite regulatory scrutiny over hardware wallet standards and liability. For Bitcoin, the event adds short-term bearish pressure, as fear of further exploits may deter new entrants and trigger sell-offs among affected users. The long-term impact hinges on Coldcard’s response and whether similar vulnerabilities exist in other devices.
What to Watch Next
- Confirmation of the fourth attack wave and final loss tally—watch for Galaxy’s updated estimates as more victims come forward.
- Movement of the stolen 1,436 BTC that remains untouched; any transfers to exchanges could signal intent to cash out.
- Coldcard’s official statement and remediation steps, including firmware patches and compensation plans, to gauge recovery of user trust.
This article is for informational purposes only and does not constitute financial advice.
Always late to trends?
Join for the latest news, insights & more.
Disclaimer: Bytewit is an independent media outlet that delivers news, research, and data.
© 2026 Bytewit. All Rights Reserved. This article is for informational purposes only.
