Coldcard Exploit Losses Near $130M as Phishing Attacks Surge

Key Point

Trezor and Foundation warned that phishing attempts against hardware wallet owners are increasing after the Coldcard firmware exploit. Proofpoint said spoofed Coldcard emails direct recipients to a cloned site with a fake "Start Hardware Audit" button. Proofpoint said the button downloads a GitHub-hosted batch file that installs ScreenConnect, a remote-access tool. Proofpoint said a real person staffs the fake customer service chat and guides victims through installation. Galaxy Research put high-confidence losses at 1,596 BTC and said total losses could reach $130 million if a suspected fourth wave is confirmed.

Why it matters: Wallet-security incidents can create urgent user behavior, which may help phishing campaigns convert fear into direct asset theft.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: Galaxy Research put high-confidence Coldcard exploit losses at 1,596 BTC, which points to active wallet-security stress.

Similar Past Cases

Ledger disclosed in 2020 that a data breach exposed about 1 million email addresses and 9,532 detailed customer records, which later created a wider phishing surface for hardware wallet users. (Ledger) The difference is that the Coldcard case centers on a firmware flaw tied to stolen Bitcoin, while the Ledger case centered on customer-data exposure.

Ripple Effect

Compromised wallet trust can push holders to move funds quickly, and that urgency can make recovery phrase scams more effective. If wallet migration continues under high fear, then fake support channels could remain a direct theft channel for self-custody users.

Opportunities & Risks

Opportunities: If Coinkite and other wallet firms publish clear verification steps, then reduced uncertainty is a potential stabilization signal for self-custody confidence.

Risks: If more victim reports lift confirmed losses or phishing emails keep using the hardware-audit theme, then reducing exposure to affected seed setups limits avoidable theft risk.