Galaxy Researchers Report $88.6 Million Bitcoin Loss From Coldcard Exploit

Galaxy researchers have documented an exploit affecting Coldcard hardware wallets that has resulted in approximately $88.6 million in Bitcoin losses across 4,585 addresses. The attackers are exploiting a firmware bug that compromised the randomness used to generate the wallet's secret recovery phrase, allowing bad actors to drain funds from affected wallets.

The theft occurred in at least three distinct waves. The first two waves followed similar patterns, including identical transaction topologies and destination types, separated by 27 hours. The third wave diverged substantially on multiple behavioral metrics—it abandoned shared collector addresses for per-victim destinations, used different output types, and employed different batching strategies—making it unclear whether the same operator conducted all three waves or whether multiple attackers are exploiting the same vulnerability.

The vulnerable firmware was distributed on March 17, 2021. Galaxy researchers used blockchain analysis to map the theft patterns, initially relying on victim reports shared on X, and note that their conclusions are based solely on analyzing Bitcoin block data and unspent outputs without independent computational verification of whether identified addresses were actually generated using the compromised firmware.

The loss distribution suggests individual self-custody was primarily targeted rather than institutional holdings. The incident has prompted Coldcard users to move quickly to secure their funds.