Coldcard Wallet Breach: Confirmed Bitcoin Losses Cross $100M, Fourth Attack Wave Under Investigation
Galaxy Research has verified over 1,596 BTC stolen across roughly 7,300 addresses in three major attack waves — and 90% of it hasn't moved.
By Jane Doe
Published on Aug 4, 2026
Cryptorah
Quick Take
- Galaxy Research has confirmed 1,596 BTC (over $100M) stolen from about 7,300 Coldcard wallet addresses across three major attack waves plus 14 smaller incidents.
- 90% of the stolen Bitcoin has not been moved by the attackers, including funds from all three confirmed waves.
- A suspected fourth wave — not yet confirmed by victims — could push total losses to 2,055 BTC (~$130M).
- Galaxy has shared attacker and victim addresses with U.S. federal law enforcement, exchanges, and cyber-investigation firms, and is urging uncertain Coldcard users to move funds to a safe address immediately.
What Happened
Galaxy Digital's research division published an update on Monday raising its confirmed tally of Bitcoin stolen through the Coldcard hardware wallet incident to 1,596 BTC — worth more than $100 million — spread across roughly 7,300 addresses. The figure covers three separate major attack waves and 14 smaller, related incidents.
The update was driven largely by victims coming forward: 73 people had contacted Galaxy's researchers by the time of publication. Those reports allowed the research team to confirm the first three major waves and, in turn, spot smaller transaction "footprints" that may belong to opportunistic attackers taking advantage of the same underlying vulnerability rather than the original attackers themselves.
This is a significant jump from Galaxy's prior estimate. As of Saturday, the confirmed figure stood at 1,367 BTC across 4,585 addresses — meaning the addresses tied to the incident grew by roughly 2,700 in just two days.
Background: What is a Coldcard wallet?
⚠️ Context, not from the source article: Coldcard is a brand of hardware wallet used to store Bitcoin private keys offline, separate from internet-connected devices, as a security measure against remote hacking. The raw source material does not explain the specific technical vulnerability behind this incident, so no details on the attack vector are included here.
Why It Matters
Hardware wallets are widely marketed as the gold standard for self-custody precisely because they're supposed to keep private keys isolated from network-based attacks. A breach at this scale — over $100 million confirmed, with a possible fourth wave adding another $30 million — undermines that core value proposition and raises questions for anyone who assumed offline storage was inherently safe from this class of exploit.
The fact that 90% of the stolen funds remain unmoved is notable on two fronts: it may make on-chain tracing and eventual recovery efforts more viable, but it also means the bulk of the theft's downstream market impact — if attackers eventually try to liquidate — has not yet happened.
The Numbers
Methodology & sourcing notes
All figures above come directly from Galaxy Research's update as reported. The Saturday figure (1,367 BTC / 4,585 addresses) and Monday figure (1,596 BTC / ~7,300 addresses) are both described as "confirmed" tallies. The 2,055 BTC / $130M fourth-wave figure is explicitly described by Galaxy as suspected and excluded from its confirmed count pending victim confirmation, with the source citing "medium-high" confidence that it represents attacker rather than victim activity.
Market Reaction
⚠️ Not covered in source: The raw content does not include Bitcoin price movement, exchange flow data, or broader market sentiment tied to this incident. No market reaction figures are available to report.
What's Next / Things to Watch
- Fourth-wave confirmation: Whether victim reports validate the suspected fourth attack wave, which would raise total losses toward 2,055 BTC (~$130 million).
- Movement of stolen funds: With 90% of stolen Bitcoin still unmoved, any future transfers could offer investigators new tracing leads — or signal attackers beginning to launder or cash out.
- Law enforcement and industry response: Galaxy Research says it has already shared attacker and victim addresses with U.S. federal law enforcement, cryptocurrency exchanges, and cyber-investigation firms.
- User action: Galaxy has urged Coldcard users who are uncertain about their wallet's security to migrate funds to a safe address immediately, indicating the vulnerability may still be exploitable.
FAQs
How much Bitcoin was stolen in the Coldcard incident?
Galaxy Research has confirmed 1,596 BTC stolen, worth over $100 million, across about 7,300 addresses. A suspected but unconfirmed fourth wave could add enough to bring the total to 2,055 BTC, or roughly $130 million.
Has the stolen Bitcoin been moved or cashed out?
According to Galaxy Research, 90% of the stolen Bitcoin — including funds from all three confirmed attack waves — has not been moved.
How many people have been affected?
As of the report, 73 victims had contacted Galaxy's researchers directly, and the stolen funds trace back to roughly 7,300 addresses.
Is the attack still ongoing?
Galaxy Research described the attacks as ongoing and advised uncertain Coldcard users to move their funds to a safe address immediately.
Who is investigating the theft?
Galaxy Research says attacker and victim wallet addresses have been shared with U.S. federal law enforcement, cryptocurrency exchanges, and cyber-investigation companies.
Endnotes
- Source: Galaxy Research update as reported by Cointelegraph. ⚠️ No specific source URLs were included in the supplied raw content, so none are linked here.
- The source article references a related piece, "Fears of AI-driven DeFi hack epidemic overstated for now — but not for long," but did not provide its URL.
Investment disclaimer: The content reflects the author’s personal views and current market conditions. Please conduct your own research before investing in cryptocurrencies, as neither the author nor the publication is responsible for any financial losses.
Ad Disclosure: This site may feature sponsored content and affiliate links. All advertisements are clearly labeled, and ad partners have no influence over our editorial content.
Related Articles
ZeroStack Flags Going-Concern Doubt After 0G Holdings Lose 91% of Their Cost Basis
ZeroStack, the Nasdaq-listed 0G treasury company formerly known as Flora Growth, has flagged substantial doubt about its ability to keep operating after an $82.5M fair value loss and a 91% drop in its token holdings' value.
Coldcard's Weak-Seed Bug Claims a Fourth Wave — Nearly 449 BTC Moved in Hours
A suspected fourth wave of Coldcard wallet drains has moved hundreds of BTC in hours, extending a weak-entropy exploit that has already taken 1,367 BTC from earlier waves. Here's what's confirmed, what's still shaky, and what affected users should do now.
Bitget to wind down Japan operations, force-close open positions by year-end
Bitget will cut off Japan-based users in phases starting Nov. 1, forcibly closing any open positions by Dec. 31 — the latest move after two FSA warnings and a 2025 Kanto Finance Bureau notice over unregistered derivatives solicitation.
Trump Cancels Iran Strikes, Jobs Data Looms: Can Crypto Break Out This Week?
Bitcoin and crypto markets face a pivotal week with Trump's Iran decision, crucial July jobs data, ISM Manufacturing PMI, and major tech earnings all converging—analysts call it 'huge' for market direction.