Bitcoin Holders Lose $88,600,000 in Coldcard Crypto Wallet Exploit: Galaxy Researchers
Crypto researchers at Galaxy have disclosed that Bitcoin investors have lost over $88 million due to an exploit in Coldcard hardware wallets. The vulnerability, caused by a firmware bug that significantly reduced the randomness of seed phrase generation, has enabled attackers to drain funds from multiple addresses.
According to Galaxy’s analysis, a third wave of the hack has removed 207.7294 BTC from affected addresses. This brings the estimated total losses to 1,367.05 BTC, worth roughly $88.6 million, spread across 4,585 addresses. The earlier waves followed similar patterns, using shared collector addresses and consistent transaction structures occurring 27 hours apart.
While the first two waves exhibit behavioral similarities suggesting a single operator, the third wave shows distinct characteristics. It uses separate destination addresses for each victim, employs different script types, and batches multiple victims per transaction. Whether this represents the same attacker with upgraded tools or an independent actor exploiting the same vulnerability remains unclear based on blockchain data alone.
The loss profile is dominated by smaller addresses holding less than 1 BTC in number, but the largest losses come from addresses with greater value. Researchers believe this pattern is more consistent with individual self-custody rather than institutional holdings.
The vulnerable Coldcard firmware was originally shipped on March 17, 2021, around block 674,951. Galaxy researchers emphasize that none of the identified stolen coins originated before that block, underscoring the timing of the vulnerability’s introduction.
The incident has prompted many Coldcard users to take protective measures. Galaxy’s team identified initial victim addresses through reports on X (formerly Twitter) and used on-chain analysis to map the attack patterns. They caution that their data is derived solely from Bitcoin block data and the unspent-output set, without computing confirmation that the identified addresses were generated with low entropy.
This exploit highlights ongoing security risks in self-custody solutions and the importance of firmware updates, even for hardware wallets designed for enhanced security.