Coldcard Bitcoin theft tops $100M across 3 confirmed attack waves: Galaxy

Confirmed losses from the Coldcard wallet incident have exceeded $100 million, with 1,596 Bitcoin (BTC) stolen from about 7,300 addresses across three separate major attack waves and 14 smaller incidents, according to a new update from Galaxy Research. 

On Monday, Galaxy Digital’s research arm said 73 victims had contacted its researchers, and victim reports confirmed the first three major attacks, helping investigators identify smaller “footprints” that Galaxy said could represent opportunistic attackers exploiting the vulnerability.

Galaxy Research also identified a suspected fourth wave that could bring total losses to 2,055 BTC, worth about $130 million. However, Galaxy said it excluded the event from its confirmed estimate because it had not yet received confirmation from victims believed to be part of that wave. The research group said with “medium-high” confidence that the wave largely represented attacker activity.

Galaxy said 90% of the stolen Bitcoin had not been moved, including funds attributed to the first three confirmed incidents. Attacker and victim addresses have been shared with US federal law enforcement, crypto exchanges and cyber-investigation companies, according to Galaxy Research. 

The new findings raise Galaxy’s confirmed estimate from the 1,367 BTC traced across 4,585 addresses, which it published on Saturday. Galaxy warned that attacks were ongoing and urged uncertain Coldcard users to migrate their funds to a safe address immediately. 

Related: Fears of AI-driven DeFi hack epidemic overstated for now — but not for long