The Coldcard wallet hack has pushed Bitcoin losses above $100 million after Galaxy Research traced 1,596 BTC from about 7,300 addresses. Researchers confirmed three major attack waves and 14 smaller incidents. A suspected fourth wave could lift losses to 2,055 BTC, worth about $130 million.
Galaxy received reports from 73 victims, helping researchers verify the first three major waves. The reports also exposed smaller transaction patterns that may involve other attackers using the same weakness.
The revised figure far exceeds the roughly $70 million first associated with the incident. Early reports differed because researchers kept identifying new addresses, victims and transaction groups as the attacks continued.
The first major sweep began on July 30 and removed about 1,082.65 BTC from 1,196 addresses within 41 minutes. Bitcoin carried an estimated value of $70.2 million at that time.
Two more waves followed. By Aug. 2, researchers had traced about 1,367 BTC across 4,585 addresses. The third wave took roughly 208 BTC from 1,912 smaller accounts.
Could more attackers have joined the theft after researchers disclosed the weakness? Galaxy said each wave followed one operator’s consistent pattern, but researchers could not connect every wave to one attacker.
The attackers did not compromise the Bitcoin network. Instead, they targeted recovery seeds that certain Coldcard firmware versions created with weak random data. A hardware wallet should generate a recovery seed from secure and unpredictable information. This process creates entropy, which protects private keys from guessing and offline reconstruction.
Coldcard introduced the flaw during a March 2021 firmware change. Seed generation moved from the device’s hardware random-number generator to software within the libNgU and MicroPython stack.
An integration error then sent the process to MicroPython’s deterministic fallback. That method relied heavily on device details and timing values, sharply reducing the number of possible seeds. Attackers could generate candidate seeds offline, derive the related Bitcoin addresses and compare them with addresses visible on the blockchain. They needed no physical access to a victim’s device.
Also Read: Ripple Invests in ZILO and Licuido to Expand Tokenized Fund Markets Globally
Coinkite estimates that affected Mk2 and Mk3 wallets produced about 40 bits of effective entropy. Mk4, Mk5 and Q models reached about 72 bits, below the intended 128 bits. The advisory covers Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9. It also covers Mk4 and Mk5 standard firmware before 5.6.0 and Edge firmware before 6.6.0X.
For Coldcard Q, the warning applies to standard firmware before 1.5.0Q and Edge firmware before 6.6.0QX. TAPSIGNER, OPENDIME and SATSCARD use separate codebases, so the flaw does not affect them. The alert also coincided with heavy movement from small Bitcoin addresses. Transfers below 1 BTC reached 39,600 BTC in one day, according to CryptoQuant research head Julio Moreno.
That total marked the highest daily movement in the category since November 2022. At that time, users moved about 39,900 BTC shortly after FTX collapsed.
Not every transfer came from a Coldcard user. Still, the timing suggests that some holders shifted funds to new wallets or exchanges after the security warning.
Galaxy Research has confirmed 1,596 BTC in losses across three attack waves and 14 smaller incidents. The flaw weakened recovery-seed randomness in several Coldcard firmware versions. Users with affected devices should follow Coinkite’s advisory and move funds to wallets created with secure, updated software.