Coldcard exploit losses exceed $100M; investigation reveals 7,300 affected addresses

What began as a reported hardware wallet breach has expanded into a major forensic investigation as new evidence continues to reshape the incident's scope. Initial analysis linked the Coldcard exploit to roughly 4,585 addresses across three theft waves, with approximately 1,367 Bitcoin stolen worth around $88.6 million. Further investigation identified an additional 1,912 affected addresses, increasing confirmed losses by 207.73 Bitcoin while revealing that all stolen coins remained unspent.

Confirmed losses now total more than 1,596 Bitcoin worth over $100 million spread across approximately 7,300 addresses. Galaxy Research identified 14 smaller related incidents, pushing suspected total losses toward 2,000 Bitcoin, or nearly $130 million. A potential fourth wave could lift suspected losses to approximately 2,055 Bitcoin, or roughly $130 million, pending victim confirmation.

Blockchain forensics reveal distinctive patterns in how stolen funds have been managed. Ninety percent of the stolen Bitcoin remains untouched in receiving addresses, suggesting the attacker prioritized consolidating funds over rapid liquidation. This inactivity has strengthened investigators' confidence in mapping attacker-controlled wallets and identifying additional linked addresses. Newly discovered smaller theft events indicate opportunistic actors may have exploited similar conditions following the initial compromise.

Investigators are providing verified addresses to law enforcement, exchanges, and compliance firms to increase tracking opportunities and limit future cash-out possibilities. The incident has raised questions about hardware wallet resilience, though observers note it exposed the need for well-designed wallets and independent entropy generators rather than a fundamental flaw with self-custody itself.