Coldcard exploit losses estimated near $130 million as fourth attack wave emerges
Security & Exploits ·
Galaxy Research says stolen Bitcoin tied to the Coldcard hardware wallet exploit has climbed above 2,000 BTC, with total losses potentially reaching $130 million.
The estimate comes from Galaxy Research, which has been tracking the incident across what it describes as four suspected attack waves. Most of the stolen Bitcoin has not moved since being taken, according to the The Block, a pattern that can make it harder to trace attacker behavior or estimate final losses with precision.
Separate reporting has tied the losses to a phishing campaign targeting Coldcard users. Victims were reportedly directed to a malicious site posing as a hardware audit tool, which instead installed remote-access malware, according to Decrypt. That reporting places losses "near $130 million," aligning with the Galaxy Research figure. Other accounts in the same cluster have cited losses "over $100 million," suggesting the total has been revised upward as more waves of theft were identified.
Galaxy Research's own posting of the findings, shared on X, frames the exploit as an ongoing incident rather than a single completed event, consistent with the multiple-wave structure described elsewhere. The mechanism described — phishing pages impersonating legitimate audit or security tools — falls into the category of off-chain exploits that target user endpoints and wallets rather than smart-contract code directly, tricking victims into installing malware or granting access rather than exploiting an on-chain vulnerability.
The scale of funds still sitting unmoved, over 2,000 BTC, leaves open questions about whether attackers are waiting out scrutiny before attempting to launder or cash out the proceeds. It is not yet clear how many distinct victims are affected, whether the four attack waves originated from the same actor or campaign, or whether losses will be revised again as investigators continue tracing the funds. What remains unresolved is whether the $130 million figure represents a ceiling or whether additional waves could push the total higher.