Coldcard Bitcoin thefts slow as Galaxy tracks potential $150 million loss
Galaxy has confirmed about $112 million in Coldcard Bitcoin thefts, while an unconfirmed cluster could push losses above $150 million.
By Theo Nakamura · Staff Writer
· 3 min read
Coldcard Bitcoin thefts have slowed, but the final cost could rise substantially if a large unconfirmed set of transactions is linked to the attack. Galaxy Research said it has high confidence that more than 1,778 Bitcoin, worth roughly $112 million, was stolen in owner-attributed cases since July 30. Its possible total above $150 million is not yet confirmed.
For holders, the distinction matters. The $112 million figure reflects losses Galaxy says it has tied to owners. The higher estimate includes a candidate fourth wave of 638.5 Bitcoin that the firm was still investigating as of its August 14 update, reported by Decrypt via Yahoo Finance.
If Galaxy confirms that cluster, the tally would reach 2,417 Bitcoin, valued at more than $151.3 million at prices at the time. Until then, it is a scenario rather than an established total.
Why are Coldcard Bitcoin thefts slowing?
Galaxy’s confirmed waves and smaller transaction clusters showed no activity after August 6. The research firm said the slowdown may mean vulnerable users have moved their funds, or that most readily accessible balances had already been taken. It said attackers had been recreating affected Coldcard-generated recovery seeds and transferring funds on-chain since at least early July 30.
A recovery seed is the series of words that controls a Bitcoin wallet. Anyone who has it can move the wallet’s funds, making its randomness central to security. Galaxy’s analysis says a 2021 Coldcard firmware update shifted seed creation from a hardware random-number chip to a software mechanism. That reportedly reduced the strength of the seeds, allowing attackers to rebuild possible seeds using device serial-number and clock-state information, without needing physical possession of the wallet.
Galaxy’s largest confirmed event, Wave 1, removed 1,082.65 Bitcoin from 1,195 addresses, worth about $70.5 million at the time. It also identified an owner-confirmed cluster called Footprint E, involving 209.94 Bitcoin across 2,148 addresses, and a third wave of 208.24 Bitcoin from 1,912 addresses. Across three proven waves and 41 smaller footprints, the firm counted more than 5,200 drained addresses.
Where has the stolen Bitcoin gone?
As of Bitcoin block 962,304 on August 13, Galaxy said 1,499.27 Bitcoin, nearly $93.9 million, remained unspent in wallets controlled by attackers. Of the 174.97 Bitcoin it could follow to a final destination, most entered CoinJoin rounds, a privacy technique that combines transactions to make tracing more difficult. Smaller amounts reached KuCoin and Jump Crypto, according to Galaxy.
Galaxy said it had spoken with more than 190 victims to help attribute losses. The firm advised people with funds in single-signature Coldcard wallets to move them to new addresses. Earlier reporting by Forbes said Coldcard maker Coinkite warned that a firmware update cannot make an already compromised seed safe; users need to migrate funds to a newly generated wallet.
Published estimates have shifted as researchers identify and classify wallet clusters. Galaxy’s August 14 confirmed figure and its unconfirmed fourth-wave estimate should therefore be treated as separate confidence levels, rather than added to prior reports.
This story draws on original reporting from Decrypt.
