Coldcard Bitcoin Hack Losses Could Reach $130M, Galaxy Says

Key Point

Galaxy Research said losses from the Coldcard bitcoin hardware vulnerability could reach 2,000 BTC, or around $130 million. Galaxy Research identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks and 14 smaller security incidents. The ongoing issue affected seeds generated on Coinkite's Coldcard Mk3, Mk4, Mk5 and Coldcard Q firmware versions. Coinkite released emergency firmware updates for all affected models and said it destroyed remaining vulnerable inventory. Galaxy Research said a potential Wave 4 lacks specific victim confirmation, but including it would bring the total to 2,055 BTC.

Why it matters: A wallet seed vulnerability can create direct custody risk and may reduce confidence in affected self-custody setups.

Market Sentiment

Cautiously Bearish, Stress-on, Tech-driven, Fear.

Reason: Galaxy Research said the vulnerability could push losses to 2,000 BTC, which may weigh on hardware wallet confidence.

Similar Past Cases

Atomic Wallet users sued over more than $100 million in crypto lost to a hack in 2023, showing that wallet-level compromises can become long-running recovery and liability events. (Bloomberg Law) Difference: Atomic Wallet involved a software wallet with multi-asset losses, while the Coldcard case centers on bitcoin seeds generated by specific hardware wallet firmware versions.

Ripple Effect

A seed-generation flaw can spread from individual wallet loss into custody behavior because users may move funds and exchanges may screen suspect coins. If additional attacker addresses are identified, then exchange monitoring and law enforcement reporting could shape whether stolen bitcoin remains contained. If the potential fourth wave gains victim confirmation, then the market may treat the incident as larger and still active.

Opportunities & Risks

Opportunities: If confirmed attacker addresses expand and stolen coins remain unmoved, then waiting for clearer recovery signals can reduce reaction risk around headline estimates.

Risks: If Wave 4 receives victim confirmation or stolen coins start moving, then reducing reliance on affected wallet setups can limit operational downside.