← Editorial Bitcoin

Coldcard Bitcoin theft exceeds $100 million across three attack waves

Galaxy Research confirms losses surpassing $100 million from the Coldcard wallet incident, with 90% of stolen funds unmoved and a suspected fourth wave potentially doubling the total.

· -9

Confirmed losses from the Coldcard wallet security incident have surpassed $100 million, with 1,596 Bitcoin stolen from approximately 7,300 addresses across three major attack waves and 14 smaller incidents, according to Galaxy Research. The firm received reports from 73 victims that confirmed the first three waves, allowing investigators to identify smaller attack footprints attributed to opportunistic actors exploiting the vulnerability.

Galaxy Research identified a suspected fourth wave that could push total losses to 2,055 Bitcoin, valued around $130 million. However, the firm excluded this wave from its confirmed estimate pending victim confirmation, though it assessed the activity as likely attacker-driven with "medium-high" confidence.

Ninety percent of the stolen Bitcoin has not been moved, including funds from the first three confirmed incidents. Attacker and victim addresses have been shared with US federal law enforcement, cryptocurrency exchanges, and cyber-investigation firms. Galaxy's new figures represent an increase from its earlier estimate of 1,367 BTC across 4,585 addresses. The research group warned that attacks were continuing and urged uncertain Coldcard users to immediately transfer funds to secure addresses.

How this piece reads Sell tone -9
Site call on Bitcoin Buy score 37.2

These two are not the same thing, and one does not produce the other. The left is how this single article reads, from its tone alone. The right is the site’s own call on the asset, from indicators and analysis. Press tone feeds no score and no signal: on the only corpus this site has measured, daily tone tracked the move that had already happened and showed no measurable link with what followed.

More on Bitcoin All pieces →

Rewritten from the headline, the teaser and the one-line summary the qualification step produced — that is all the material there is, and nothing is added to it. The source link is kept on file so any item can be checked, and is not published here.