Coldcard Bitcoin theft tops $100M across 3 confirmed attack waves: Galaxy
Confirmed losses from the Coldcard wallet incident now exceed $100 million. Galaxy Research says 1,596 BTC have been stolen from about 7,300 addresses across three confirmed major attack waves and 14 smaller incidents. The update follows contact from 73 victims, whose reports helped confirm the first three waves and identify smaller “footprints” likely tied to opportunistic exploitation of the same vulnerability. Galaxy also found a suspected fourth wave that could lift total losses to 2,055 BTC, or about $130 million, but excluded it from confirmed totals because victim confirmation is still missing. About 90% of the stolen bitcoin has not moved, including funds from the first three confirmed incidents. Galaxy says attacker and victim addresses were shared with US federal law enforcement, exchanges, and crypto forensics firms. The confirmed estimate rose from 1,367 BTC across 4,585 addresses reported earlier, and users unsure about exposure were urged to move funds immediately.
