Coldcard Bitcoin Exploit Involves at Least 15 Attackers, Galaxy Digital Says

Key Point

Galaxy Digital Head of Research Alex Thorn said at least 15 attackers are currently believed to have taken part in the theft of Bitcoin through a Coldcard hardware wallet vulnerability. Onchain Lens said earlier that the Coldcard incident is estimated to have resulted in the theft of 1,816 BTC so far. Onchain Lens said the stolen Bitcoin is worth $114 million.

Why it matters: Wallet-level exploits can weaken self-custody confidence and may increase scrutiny of hardware wallet security models.

Market Sentiment

Bearish, Stress-on, Event-driven, Fear.

Reason: The estimated theft of 1,816 BTC through a hardware wallet vulnerability creates direct custody-risk pressure for Bitcoin holders.

Similar Past Cases

The 2022 Slope Wallet incident drained 9,231 wallets of about $4.1 million during roughly four hours after private keys for affected wallets were leaked or compromised. Solana Foundation said affected addresses had at one point been created, imported, or used in Slope wallet applications. (Solana) Difference: The Slope case involved a software wallet application, while the Coldcard case involves hardware wallet vulnerability claims and a much larger stated Bitcoin loss.

Ripple Effect

Custody-risk incidents can spread through confidence channels before broader liquidity channels. If users question hardware wallet key isolation, then self-custody providers may face heavier scrutiny and slower onboarding. If additional stolen Bitcoin is identified, then trading venues and custody desks may tighten monitoring of tainted flows.

Opportunities & Risks

Opportunities: If Coldcard or investigators publish a confirmed vulnerability scope, then confirmed containment is a potential confidence-stabilization signal for self-custody sentiment.

Risks: If the estimated stolen BTC total keeps rising, then reducing exposure to custody-risk narratives limits downside from renewed fear.