Coldcard Bitcoin wallet exploit expands to $88M in losses across 4,585 addresses as attackers continue draining funds in a third wave.
Security & Exploits ·
Galaxy Research has identified three waves of attacks targeting addresses generated by Coldcard wallets, with the most recent sweep draining 207.7294 BTC from compromised holdings. The cumulative theft across all three waves totals approximately 1,367.05 BTC—roughly $88.6 million—from 4,585 addresses, according to analysis of Bitcoin block data and unspent-output sets.
The three waves exhibit distinct behavioral patterns in their execution and fund movement. Waves 1 and 2 share similar characteristics including comparable time intervals, shared collector addresses, and identical destination formats, suggesting they may stem from the same operator. Wave 3 diverges significantly—it abandons shared collectors in favor of one destination per victim, holds funds in a different format, batches multiple victims per sweep, and targets only default derivation paths. These differences create ambiguity about whether all three waves originate from a single attacker who evolved their tooling or from multiple actors independently exploiting the same vulnerability.
Galaxy Research emphasized that their findings derive solely from on-chain analysis and remain incomplete pending further investigation. The researchers have not computationally verified whether identified victim addresses were generated with low entropy, and they cautioned that attribution between waves relies on pattern similarity rather than definitive proof. All attacker-controlled addresses identified to date remain entirely unspent on-chain.