Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy
Galaxy Research says the Coldcard seed-recreation exploit has stolen more than 1,778 BTC, worth about $112 million, and the final total may be higher. Attackers have been draining funds since at least July 30 by reconstructing seeds from device data rather than using phishing or malware, with no need for physical access. A 2021 firmware change weakened key generation, allowing seeds to be derived from serial number and clock state. The largest confirmed wave took 1,082.65 BTC from 1,195 addresses, while another major cluster took 209.94 BTC. Across three confirmed waves and 41 smaller footprints, more than 5,200 addresses were drained. Most stolen BTC remains unmoved in attacker-controlled wallets, and most traced outflows went through CoinJoin. Galaxy says attack activity appears to have slowed because easy targets are gone, and advises anyone still holding single-signature Coldcard funds to move them to new addresses.
