Intelligence Brief
Galaxy Research has linked 1,596 BTC from roughly 7,300 addresses to three confirmed attack waves and 14 smaller incidents involving vulnerable Coldcard wallet seeds.
A suspected fourth sweep could raise the estimate to 2,055 BTC, worth approximately $130 million at the reported Bitcoin price. Galaxy excluded that sweep from its confirmed figure because affected victims had not verified the addresses. The firm assessed the connection with medium-high confidence.
????LOSSES FROM COLDCARD HACK EXCEED $100M
High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.
If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).
More in the thread below ???? pic.twitter.com/RAl3ib67qa
— Galaxy Research (@glxyresearch) August 3, 2026
Galaxy said about 90% of the stolen Bitcoin remained unmoved when it published its findings. Suspected attacker and victim addresses were supplied to law enforcement agencies, exchanges and investigation firms.
Coinkite’s advisory confirms that affected firmware generated seeds with insufficient entropy across several Coldcard models. Installing corrected firmware prevents the same fault when creating a new seed, but it cannot repair a seed produced by vulnerable software.
Unless users supplied sufficient independent dice entropy or protected the wallet with a strong, unique BIP-39 passphrase, funds must be transferred to an entirely new seed generated on corrected firmware.
Strategic Assessment
The central risk is persistence. A firmware update can secure future generation, but every exposed seed remains vulnerable until the funds move.
Users who installed an update without replacing their seed may wrongly believe the problem is resolved. That creates a continuing pool of targets, particularly if attackers are still calculating or purchasing candidate keys.
Affected holders carry the direct loss. Exchanges and investigators may benefit from the fact that most attributed Bitcoin has not moved, giving compliance teams time to flag destination addresses. Recovery is still uncertain because a valid Bitcoin transaction cannot be reversed.
The 2,055 BTC maximum should not be treated as confirmed. On-chain clustering can identify matching behavior, but it cannot establish every victim or prove that one attacker controls every address.
