Coldcard Hack: $115M Bitcoin Losses

The update

Galaxy Research has confirmed that losses from the ongoing Coldcard wallet hack have surpassed $115 million. The theft, which began in late July, exploits a firmware vulnerability that allowed attackers to recreate seed phrases from device serial numbers. Galaxy has spoken to over 200 victims and estimates that at least 15 separate attackers are involved. The attack rate has slowed recently, likely because the most vulnerable wallets have already been drained.

Why it matters

This is one of the largest hardware wallet breaches in crypto history. The flaw, which silently rerouted seed generation to a weak software generator, undermines the fundamental security promise of hardware wallets. The stolen funds have largely remained untouched, with 88% of the pilfered coins being at least a year old, indicating that victims were not actively monitoring their wallets.

What to watch

Galaxy Research maintains that total losses could exceed $150 million. The firm is still working to confirm the final figure, and the slow pace of recent thefts suggests that the remaining vulnerable wallets may have already been emptied. Investors are being urged to move funds to fresh addresses immediately.

Sources

• bitcoinmagazine.com — Confirmed $115 million loss figure and victim support efforts.
• decrypt.co — Analysis of the slowing theft rate and potential final totals.