Coldcard Bitcoin Thefts Sluggish, However Losses Might High $150 Million: Galaxy – Decrypt

Stolen Bitcoin losses from the huge Coldcard pockets exploit have begun to sluggish, however the whole quantity of BTC swiped continues to climb—and the worst might not be over simply but.

That’s the newest from Galaxy Analysis, the crypto analysis agency that’s been monitoring the exploit from the beginning. The corporate stated Thursday that the Coldcard seed-recreation exploit has now drained greater than 1,778 BTC—roughly $112 million—and the ultimate determine will possible be greater.

Galaxy stated it has “very excessive confidence” within the tally, which counts confirmed, owner-attributed thefts for the reason that assault opened on July 30, per its working thread on X.

“Attackers have been executing this assault since at the least early morning July 30, 2026, systematically recreating Coldcard-generated seeds and sweeping the funds onchain,” Galaxy Analysis wrote.

Amongst Galaxy’s confirmed waves and footprints, none reveals exercise after August 6. That does not imply the strategy stopped working. It means the simple targets are gone.

What the chains present

A 2021 firmware replace quietly rerouted Coldcard’s seed era off its {hardware} random-number chip and onto a software program stand-in, collapsing key energy from 128 bits to as little as 40. Attackers might rebuild seeds from a tool’s serial quantity and clock state, then sweep the cash with out resorting to phishing or malware methods and even with out bodily entry to the precise units.

Galaxy’s breakdown places the biggest confirmed wave—Wave 1—at 1,082.65 BTC pulled from 1,195 addresses within the opening minutes. That was roughly $70.5M value of Bitcoin stolen on the time.

Footprint E, the most important single owner-confirmed cluster, took 209.94 BTC (roughly $13.3M) throughout 2,148 addresses; Wave 3 took 208.24 BTC (close to $13.0M) from 1,912. Throughout three confirmed waves and 41 smaller footprints, the agency charts greater than 5,200 drained addresses. As of block 962,304 (information Aug. 13), 1,499.27 BTC (almost $93.9M) sat unspent in attackers’ arms.

Of the skinny slice Galaxy can hint to a remaining endpoint—174.97 BTC—most went into coinjoin privateness rounds, with small quantities reaching KuCoin and Leap Crypto.

Galaxy has spoken to greater than 190 victims on to attribute losses. “The abatement in assault waves is probably going as a result of weak customers have migrated or most funds have already been drained,” it wrote. The corporate repeats its recommendation: “If you happen to nonetheless maintain funds on a single-signature Coldcard pockets, you might be suggested to maneuver your funds to new addresses.”

The episode has already pushed roughly $15 billion in Bitcoin to safer custody and drawn a warning from Ledger that pockets safety has to adapt to AI-assisted discovery. {Hardware}-firm friends have additionally flagged a phishing surge using the panic.

Galaxy nonetheless carries a candidate fourth wave—638.5 BTC it hasn’t confirmed—that may elevate the toll to 2,417 BTC, above $151.3 million by right this moment’s costs.