The theft of Bitcoin from compromised Coldcard hardware wallets is still underway, with researchers now tracking losses of roughly $88 million and warning that every vulnerable device will eventually be emptied.<\/p>\n
Galaxy Research said Saturday it has identified a third wave of thefts, in which 207.73 BTC was drained, lifting its observed tally to about 1,367 BTC\u2014around $88.6 million\u2014across 4,585 addresses. The firm called the exploit ongoing and urged anyone holding single-signature funds on a Coldcard to move them at once. Galaxy said it has flagged roughly 600 suspected attacker addresses to federal investigators, compliance firms and cross-industry cyber investigators, crediting victims who shared transaction details for helping map the on-chain patterns.<\/p>\n
\u201cI continue to investigate and add new Coldcard victim and attacker addresses to our investigation database,\u201d Galaxy\u2019s head of research Alex Thorn posted to X<\/a>. \u201cThe attack is ongoing\u2014move your funds off Coldcard-generated addresses immediately if you have not done so.\u201d<\/p>\ni continue to investigate and add new Coldcard victim and attacker addresses to our investigation database tonight<\/p>\n
THE ATTACK IS ONGOING — move your funds off Coldcard-generated addresses immediately if you have not done so. i will provide additional updates on estimated\u2026<\/p>\n
\u2014 Alex Thorn (@intangiblecoins) August 2, 2026<\/a><\/p>\nThe flaw, as Decrypt previously reported<\/a>, stems from a March 2021 firmware build error on Coinkite’s devices that caused seed phrases to be generated with far too little randomness, leaving private keys guessable. Thorn wrote that the sweeps look deliberate and programmatic, probably orchestrated with a large language model, and cautioned that every single-sig Coldcard address created after that 2021 update will eventually be drained, saying it is only a matter of time.<\/p>\nThorn noted the stolen coins had sat untouched for years before being taken\u2014an average dormancy of 3.18 years\u2014underscoring that the victims were long-term holders. The funds from the three documented waves remain parked in attacker addresses and have not moved.<\/p>\n
The fallout has driven a panicked response from affected users, with security experts urging caution when moving funds to new addresses. Many of the affected users are racing to move Bitcoin off self-custody and back onto centralized crypto exchanges, such as Coinbase or Binance, or freshly generated addresses\u2014an inversion of the industry’s usual “not your keys, not your coins” ethos.<\/p>\n
$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack.<\/p>\n
My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet.<\/p>\n
This part’s nerdy, but here’s\u2026 pic.twitter.com\/Lf9kJv9Jo4<\/a><\/p>\n\u2014 Jonathan Goodman \ud83c\udde8\ud83c\udde6 (@itscoachgoodman) August 1, 2026<\/a><\/p>\nFor some, the warnings<\/a> came too late. Canadian coach Jonathan Goodman<\/a> said in a post on X that 18.25 BTC, worth about $1.6 million Canadian, was swept from his wallets in a seven-minute span on July 29, despite his keys sitting in a safety deposit box that never touched the internet. “Perhaps the hardest part about this is that I did everything right,” he wrote, adding that he is filing reports with police and the Ontario Securities Commission.<\/p>\nDaily Debrief Newsletter<\/p>\n
Start every day with the top news stories right now, plus original features, a podcast, videos and more.<\/p>\n