Coldcard Bitcoin theft tops $100M across 3 confirmed attack waves: Galaxy

Written by Ezra Reguerrastaff writerReviewed by Felix Ngstaff editorWritten by Ezra Reguerrastaff writerReviewed by Felix Ngstaff editorColdcard Bitcoin theft tops $100M across 3 confirmed attack waves: GalaxyLatest NewsPublishedAug 4, 2026<!–>

Galaxy Research said 90% of the stolen Bitcoin remains unmoved as investigators examine a suspected fourth wave that could lift losses to $130 million.

–>

Confirmed losses from the Coldcard wallet incident have exceeded $100 million, with 1,596 Bitcoin (BTC) stolen from about 7,300 addresses across three separate major attack waves and 14 smaller incidents, according to a new update from Galaxy Research. 

On Monday, Galaxy Digital’s research arm said 73 victims had contacted its researchers, and victim reports confirmed the first three major attacks, helping investigators identify smaller “footprints” that Galaxy said could represent opportunistic attackers exploiting the vulnerability.

Galaxy Research also identified a suspected fourth wave that could bring total losses to 2,055 BTC, worth about $130 million. However, Galaxy said it excluded the event from its confirmed estimate because it had not yet received confirmation from victims believed to be part of that wave. The research group said with “medium-high” confidence that the wave largely represented attacker activity.

Galaxy said 90% of the stolen Bitcoin had not been moved, including funds attributed to the first three confirmed incidents. Attacker and victim addresses have been shared with US federal law enforcement, crypto exchanges and cyber-investigation companies, according to Galaxy Research. 

The new findings raise Galaxy’s confirmed estimate from the 1,367 BTC traced across 4,585 addresses, which it published on Saturday. Galaxy warned that attacks were ongoing and urged uncertain Coldcard users to migrate their funds to a safe address immediately. 

Related: Fears of AI-driven DeFi hack epidemic overstated for now — but not for long

<!–>

Subscribe to daily byte-sized crypto news from Cointelegraph

[–> Subscribe Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Hackers
• Hacks
• Bitcoin Wallet
• Wallet
• Security
• Cybersecurity
• Bitcoin

More on the subject

<!–>[–>5 hours agoAndrew Fenton<!–>[–>

<!–>[–>16 hours agoRobert Lakin<!–>[–>

<!–>[–>18 hours agoZoltan Vardai

<!–>[–>5 hours agoAndrew Fenton<!–>[–>

<!–>[–>16 hours agoRobert Lakin<!–>[–>

<!–>[–>18 hours agoZoltan Vardai