Key Takeaways:
Investigators are still counting the damage from the Coldcard exploit, with confirmed losses already exceeding $111 million and no definitive total in sight.
At least $111 million in Bitcoin has been stolen in the Coldcard hardware-wallet exploit, with Galaxy Research warning total losses could exceed $130 million.
Galaxy directly confirmed more than 450 BTC through victim reports, though it suspects higher amounts that cannot yet be corroborated, Alex Thorn, head of digital assets research at Galaxy, said.
CryptoQuant puts confirmed losses at 1,432 BTC, while TRM Labs estimates attackers drained about 1,816 BTC from more than 5,200 addresses across four waves. The median victim lost more than 1 BTC, and 88 percent of the stolen funds had sat untouched for at least a year.
The gap between confirmed and suspected losses shows how hard self-custody attacks are to quantify, since no central ledger of affected accounts exists. Investigators expect the estimate to keep rising as more victims come forward.
Galaxy's high-confidence minimum stood at 1,730 BTC as of Tuesday, with the firm still withholding funds it suspects but cannot yet verify, Thorn said. TRM Labs said its independent tracing lands in the same range, while CryptoQuant's stricter approach — starting from public victim reports and checking them against known attack patterns — yields a 1,432 BTC floor.
Julio Moreno, head of research at CryptoQuant, said the total will remain an estimate because investigators can only confirm what victims disclose. "Because the stolen Bitcoin belonged to individuals and not to a centralized entity, like an exchange, we can only confirm what each victim publicly discloses," he said.
The attack stemmed from a firmware vulnerability in Coldcard Mk3 devices running software beginning with version 4.0.1, released in March 2021. The flaw caused some wallet seed generation to fall back to a weak software-based pseudorandom number generator, sharply reducing the randomness used to create seeds. Coinkite, the maker of Coldcard, has urged affected users to move funds.
About 83 percent of the stolen Bitcoin remains concentrated in five wallets holding a combined 1,127 BTC, according to CryptoQuant. The funds have not been moved to exchanges or mixing services, a common laundering step, suggesting the attackers may be waiting before attempting to liquidate.
The concentration gives blockchain forensic firms and law enforcement a rare target for tracking and potential recovery. The incident also highlights the risk facing long-dormant wallets: most stolen Bitcoin had not moved for years, leaving funds exposed if the original seed generation was compromised.
With confirmed losses above $111 million and Galaxy warning the total could exceed $130 million, the Coldcard incident ranks among the most significant recent Bitcoin wallet security events. For users with potentially affected devices, checking wallet status and following official guidance should be a priority.
This article is for informational purposes only and does not constitute investment advice.
