Galaxy estimates Coldcard exploit may have stolen up to 2,055 Bitcoin
Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130 million, if a suspected fourth wave is verified. Galaxy Research said in a post published Monday on X that it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, along with 14 smaller security incidents linked to the Coldcard seed-generation flaw. The research firm said its latest estimate excludes a fourth suspected attack wave because it has not yet received enough confirmation from affected wallet owners. If the additional activity is validated, the total would rise to 2,055 BTC, valued at about $130 million at current prices. Earlier blockchain analysis from Galaxy had estimated roughly 1,815.75 BTC moving across four observed waves, but the firm emphasized at the time that the figures came from on-chain analysis rather than confirmed victim reports. The latest update narrows confirmed losses while keeping the larger estimate tied to the still-unverified fourth wave. Coldcard attack investigation remains active Galaxy said it has identified what it believes is a fourth coordinated wave of theft but is still waiting for victim confirmation before adding those addresses