Coldcard Bitcoin Theft Tops $100M Across Three Attack Waves

Key Point

Galaxy Research said confirmed losses from the Coldcard wallet incident exceeded $100 million, with 1,596 Bitcoin stolen from about 7,300 addresses. Galaxy Research said 73 victims contacted its researchers and helped confirm the first three major attack waves. Galaxy Research identified a suspected fourth wave that could bring total losses to 2,055 BTC, worth about $130 million, but excluded that wave from the confirmed estimate because victim confirmation was not yet received. Galaxy Research said 90% of the stolen Bitcoin had not moved and said attacker and victim addresses were shared with US federal law enforcement, crypto exchanges, and cyber-investigation companies. Galaxy Research warned that attacks were ongoing and urged uncertain Coldcard users to migrate funds to a safe address immediately.

Why it matters: Wallet exploits can reduce self-custody confidence and could force users to move funds quickly if risk remains active.

Market Sentiment

Cautiously Bearish, Stress-on, Event-driven, Fear.

Reason: Confirmed losses above $100 million can weaken confidence in self-custody security and raise operational risk for Bitcoin holders.

Similar Past Cases

In 2023, Atomic Wallet users sued over more than $100 million in crypto lost to a hack, which turned a wallet compromise into a recovery and liability dispute. (Bloomberg Law) Difference: Atomic Wallet involved a multi-asset software wallet, while the current incident centers on Bitcoin stored through Coldcard.

Ripple Effect

A wallet compromise can spread through custody behavior because users may move coins from vulnerable addresses into safer storage. If the unmoved stolen Bitcoin begins moving, then exchanges and investigators may face more urgent tracing and blocking decisions.

Opportunities & Risks

Opportunities: If attacker addresses remain unmoved and exchanges act on shared data, then renewed confidence in containment could become a cautious re-entry signal for affected-sector risk.

Risks: If attacks remain ongoing or the suspected fourth wave is confirmed, then reducing exposure to affected wallet paths limits operational downside until safe migration is complete.