Coldcard wallet thefts may total 1,806 BTC, worth $143.9M
Security & Exploits ·
Attacker linked to a Coldcard hardware wallet exploit continues to move stolen bitcoin as researchers tally losses now approaching $143.9M.
Galaxy Research estimates the exploiter has drained approximately 1,806 BTC, currently worth about $143.9 million, according to The Block. Of that total, 82% remains sitting in attacker-controlled addresses, meaning the bulk of the stolen Bitcoin has not yet been laundered or cashed out.
The exploit appears to have unfolded in stages. A separate tally from Galaxy Research cited in the cluster puts an earlier count at 1,779 BTC stolen from 190 victims, with the attacker moving 45% of funds taken in a "Wave 3" batch of attacks. The discrepancy between the 1,779 BTC and 1,806 BTC figures suggests the theft total has been revised upward as tracking continues, though it is not clear from available material whether this reflects new victims being identified or additional transfers being attributed to the same attacker.
Coldcard is a hardware wallet product, and the nature of the exploit that allowed funds to be extracted from victim wallets is not detailed in the available material. What is established is that the attack affected a specific set of victims — at least 190 as of the earlier count — and that the perpetrator has been actively moving portions of the stolen funds in tracked waves rather than immediately liquidating the full amount.
The fact that 82% of the stolen BTC remains parked in attacker-controlled addresses is significant for tracking purposes: it gives researchers and potentially law enforcement a window to monitor movement before funds reach exchanges or mixers where tracing becomes harder. Movement of the remaining 45% tied to Wave 3 specifically indicates the attacker is proceeding methodically rather than in a single bulk transfer.
Unresolved questions include the precise mechanism of the Coldcard compromise, whether affected users have any recourse, and how the victim count and stolen-fund total might continue to shift as Galaxy Research and other trackers refine their figures. It also remains unclear where the moved funds are being routed and whether any portion has reached centralized exchanges, which would mark a shift from the current holding pattern described in the reporting.