Galaxy Research Puts Confirmed Coldcard Losses Above $100 Million as a Suspected Fourth Wave Nears $130 Million

Confirmed losses from the Coldcard hardware wallet exploit have crossed $100 million, with Galaxy Research saying Monday it has high confidence that 1,596 BTC was taken from about 7,300 addresses across three major attack waves and 14 smaller incidents. A suspected fourth wave, which Galaxy says it holds at medium-high confidence, would lift the total to 2,055 BTC, or roughly $130 million.

Galaxy kept the fourth wave out of its confirmed count because it has not yet heard from the wallet owners it believes were hit. Seventy-three victims have contacted the firm so far, and their reports confirmed the first three waves and helped investigators identify the smaller footprints, which Galaxy said may be opportunistic attackers working the same flaw. About 90% of the stolen bitcoin has not moved. Attacker and victim addresses have gone to US federal law enforcement, crypto exchanges, and cyber investigation firms.

This story is an excerpt from the Unchained Daily newsletter.

The number has roughly tripled in five days, from $38 million when the first sweep surfaced, to $88.6 million by Saturday, to above $100 million now, and Galaxy says the attacks are ongoing.

The failure traces to a March 2021 build error in Coldcard’s firmware. A configuration setting told the device to skip its own hardware random number generator, and a supporting library checked only whether the setting existed rather than whether it was switched on, so key generation fell back to a software substitute seeded from the chip’s serial number and timer registers. Neither input is secret.

Fixed firmware shipped July 31 but does not repair an existing seed.

Related Listen: How Lyn Alden Will Take on Bitcoin DATs and Private Equity With Orange Juice