Galaxy Research now puts the Coldcard exploit’s confirmed haul above 1,778 BTC (about $112 million), with a suspected fourth wave that would lift it to 2,417 BTC.
No confirmed attacker activity has appeared after August 6, across three major waves and more than 30 smaller footprints.
Galaxy has spoken to 190-plus victims directly and still tells single-signature Coldcard holders to move funds to fresh addresses.
Stolen Bitcoin losses from the massive Coldcard wallet exploit have begun to slow, but the total amount of BTC swiped continues to climb—and the worst may not be over just yet.
That’s the latest from Galaxy Research, the crypto research firm that’s been tracking the exploit from the start. The company said Thursday that the Coldcard seed-recreation exploit has now drained more than 1,778 BTC—roughly $112 million—and the final figure will likely be higher.
Galaxy said it has “very high confidence” in the tally, which counts confirmed, owner-attributed thefts since the attack opened on July 30, per its running thread on X.
“Attackers have been executing this attack since at least early morning July 30, 2026, systematically recreating Coldcard-generated seeds and sweeping the funds onchain,” Galaxy Research wrote.
Among Galaxy’s confirmed waves and footprints, none shows activity after August 6. That doesn’t mean the method stopped working. It means the easy targets are gone.
The bulk of funds have remained largely unmoved since stolen from victims. Of the at least 1,778 BTC that has been stolen, 1,531 BTC remains in attacker-controlled addresses unmoved. ~246 BTC has been moved by attackers after the theft, with 65% flowing into Coinjoin transactions… pic.twitter.com/OHjJkr1x6D
A 2021 firmware update quietly rerouted Coldcard’s seed generation off its hardware random-number chip and onto a software stand-in, collapsing key strength from 128 bits to as low as 40. Attackers could rebuild seeds from a device’s serial number and clock state, then sweep the coins without resorting to phishing or malware techniques and even without physical access to the actual devices.
Galaxy’s breakdown puts the largest proven wave—Wave 1—at 1,082.65 BTC pulled from 1,195 addresses in the opening minutes. That was roughly $70.5M worth of Bitcoin stolen at the time.
Footprint E, the biggest single owner-confirmed cluster, took 209.94 BTC (roughly $13.3M) across 2,148 addresses; Wave 3 took 208.24 BTC (near $13.0M) from 1,912. Across three proven waves and 41 smaller footprints, the firm charts more than 5,200 drained addresses. As of block 962,304 (data Aug. 13), 1,499.27 BTC (nearly $93.9M) sat unspent in attackers’ hands.
Among the confirmed, high-confidence waves and footprints of attacker activity, none occurred after August 6. Additional victims continue to report to Galaxy Research (we’ve spoken to 190+ directly), helping us directly attribute losses and confirm additional footprints, but none… pic.twitter.com/8jEdFdJEog
Of the thin slice Galaxy can trace to a final endpoint—174.97 BTC—most went into coinjoin privacy rounds, with small amounts reaching KuCoin and Jump Crypto.
Galaxy has spoken to more than 190 victims directly to attribute losses. “The abatement in attack waves is likely because vulnerable users have migrated or most funds have already been drained,” it wrote. The company repeats its advice: “If you still hold funds on a single-signature Coldcard wallet, you are advised to move your funds to new addresses.”
The episode has already pushed roughly $15 billion in Bitcoin to safer custody and drawn a warning from Ledger that wallet security has to adapt to AI-assisted discovery. Hardware-firm peers have also flagged a phishing surge riding the panic.
Galaxy still carries a candidate fourth wave—638.5 BTC it hasn’t confirmed—that would lift the toll to 2,417 BTC, above $151.3 million by today’s prices.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
