Coldcard hardware wallet exploit losses estimated at $130 million
Security & Exploits ·
Galaxy Research says a suspected fourth wave of attacks has pushed stolen Bitcoin past 2,000 BTC, with most of the funds still unmoved.
Galaxy Research estimates that losses tied to an exploit of the Coldcard hardware wallet could reach $130 million, according to The Block. The firm points to a suspected fourth wave of attacks that has pushed the total amount of stolen Bitcoin above 2,000 BTC.
Coldcard is a hardware wallet used to store Bitcoin private keys offline, a setup generally considered more resistant to remote theft than software wallets. The scale of the losses attributed to it therefore stands out, since hardware wallets are typically the tool users rely on to avoid exactly this kind of exploit.
Galaxy Research's assessment indicates the attacks unfolded across four separate waves rather than a single incident, suggesting a sustained or repeated campaign against Coldcard users or their devices rather than one-off theft. Despite the scale of the funds reported stolen, most of the Bitcoin taken has not yet moved on-chain, according to the same reporting.
The case is one instance in a broader pattern of exploits across the crypto ecosystem, where vulnerabilities in code, infrastructure, or user behavior are abused for financial gain, spanning smart contracts, bridges, and end-user devices alike.
What remains unresolved is the precise mechanism attackers used to compromise Coldcard devices or user funds, along with why a fourth wave occurred after earlier ones, and whether the unmoved bulk of the stolen 2,000 BTC will surface or be recovered before being moved.