Coldcard Flaw Siphons $112M in Bitcoin, Galaxy Warns Losses Could Top $150M

Coldcard exploit has already siphoned roughly $112M in Bitcoin — and the final toll could top $150M, Galaxy Research warns. What happened - A flaw tied to a 2021 Coldcard firmware change allowed attackers to systematically recreate device seeds. That update quietly rerouted seed generation from the hardware random-number generator to a software component, drastically collapsing entropy from 128 bits down to as little as 40 bits. Using device serial numbers and clock-state information, attackers were able to rebuild private keys and sweep funds without phishing, malware, or physical access. Latest tally and timeline - Galaxy Research, which has been tracking the incident since the attack began in the early hours of July 30, 2026, reports “very high confidence” that at least 1,778 BTC (roughly $112 million) have been stolen from confirmed, owner-attributed addresses. Galaxy has spoken directly to more than 190 victims to attribute losses. - The biggest, proven initial strike — “Wave 1” — pulled 1,082.65 BTC from 1,195 addresses within minutes (about $70.5M at the time). Other notable confirmed clusters include: - Footprint E: 209.94 BTC across 2,148 addresses (~$13.3M) - Wave 3: 208.24 BTC from 1,912 addresses (~$13.0M) - Across three confirmed waves and 41 smaller footprints, Galaxy charts more than 5,200 drained addresses. Where the coins are now - As of block 962,304 (data through Aug. 13), about 1,499.27 BTC (nearly $93.9M) remain unspent in attacker-controlled addresses. Of the 1,778 BTC recorded as stolen, roughly 1,531 BTC is unmoved; about ~246 BTC was moved after theft. - Around 65% of the moved coins flowed into CoinJoin privacy rounds. Of the ~175 BTC Galaxy can trace to final endpoints, most went to CoinJoin, with small amounts routed to KuCoin and Jump Crypto. Is the attack still happening? - Galaxy notes that no confirmed, high-confidence waves or footprints show activity after Aug. 6. That likely means the easiest, vulnerable targets have already been drained — not necessarily that the exploit no longer works. New victims continue to report in, and Galaxy is still attributing additional losses. - The firm offers practical advice: if you still hold funds on a single-signature Coldcard wallet, move your funds to new addresses immediately. Wider impact and warnings - The breach has driven behavior change across the market: an estimated $15 billion in Bitcoin has moved into “safer custody” since the incident surfaced. - Hardware wallet makers have taken note. Ledger has flagged the broader lesson that wallet security must adapt to AI-assisted attack methods, and other hardware peers have warned of a phishing surge exploiting user panic. Could losses climb higher? - Galaxy is tracking a candidate fourth wave of 638.5 BTC that it has not yet confirmed. If validated, that would push the total to roughly 2,417 BTC — more than $151.3 million at current prices. Bottom line The Coldcard seed-reconstruction exploit remains one of 2026’s most consequential hardware-wallet incidents: massive, automated thefts exploiting a subtle firmware change. While the attack waves appear to have slowed, large sums are still sitting in attacker-controlled wallets, and further confirmations could raise the final loss figure substantially. Users with single-signature Coldcard holdings should relocate funds immediately and follow updates from investigators.