Bitcoin losses from Coldcard hack could swell to $130 million, Galaxy Research says

Galaxy Research said losses from the Coldcard bitcoin hardware vulnerability could amount to 2,000 BTC (BTC), or around $130 million.

In a Monday post on social media platform X, Galaxy Research said it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, plus 14 smaller security incidents.

These attacks stemmed from an ongoing issue affecting seeds generated on Coinkite's Coldcard Mk3, Mk4, Mk5 and Coldcard Q firmware versions. Coinkite later released emergency firmware updates for all affected models, and said it has destroyed remaining vulnerable inventory.

The issue first came to light when multiple reports of exploits emerged on July 30, in what appears to have been an automated, programmatic sweep with possible LLM assistance. 

Galaxy wrote in its X post that it suspects the losses to be greater once the yet-unconfirmed fourth wave of attacks is included.

Fourth Wave

"While we have also identified a potential Wave 4, we have yet to receive specific victim confirmation of inclusion in this wave," Galaxy said. "Including it would bring the total to 2,055 BTC ($130m)."

Galaxy stated that it holds medium-high confidence that Wave 4 is "substantially comprised of" one attacker, but noted that it lacks sufficient victim confirmation. Galaxy Head of Firmwide Research Alex Thorn flagged the potential existence of Wave 4 on Tuesday, noting that the transaction pattern matches that of previous waves of attacks.

The research firm also stated that it has been cooperating with U.S. federal law enforcement agencies, crypto exchanges, and cyber investigation groups by providing confirmed addresses of the attacker and victims.

"90% of stolen coins have not moved. 100% of coins in Waves 1, 2, and 3 have not moved," Galaxy said. "It is essential that we continue to identify additional attacker addresses, especially as new, opportunistic attackers emerge, so that we can report their addresses to authorities."

Galaxy added that the attack is still ongoing, and urged Coldcard users to migrate their funds to a safe address and generate a new seed on a secure device.