Galaxy Research has confirmed that losses from the Coldcard wallet incident now exceed $100 million, with 1,596 Bitcoin stolen from 7,300 addresses across three major attack waves and 14 smaller incidents. The research arm of Galaxy Digital analysed the breach, revealing that 73 victims contacted its researchers, though the full scale of the theft remains unclear.
A suspected fourth wave, potentially involving 2,055 Bitcoin worth an estimated $130 million, has not been confirmed due to a lack of victim reports. Galaxy Research attributed the incident to attackers with “medium-high” confidence but excluded the fourth wave from its current loss estimates.
Over 90% of the stolen Bitcoin, including the first three confirmed incidents, remains unmoved, suggesting ongoing efforts to trace or recover the assets. Coldcard, the hardware wallet provider targeted in the incident, has not publicly commented on the findings.
The attack underscores growing vulnerabilities in cryptocurrency security, with Galaxy Digital’s analysis highlighting the need for enhanced safeguards amid escalating threats to digital asset custodians.
Written by Daniel Brooks
Security Desk
