Galaxy Research has linked the Coldcard hardware wallet exploit to 1,596 stolen Bitcoin across three confirmed attack waves, with losses drawn from approximately 7,300 addresses. A suspected fourth wave, if confirmed, could raise the total to roughly 2,055 BTC, valued at nearly $130 million based on current Bitcoin prices. Coldcard, manufactured by Coinkite, is a popular hardware wallet among Bitcoin self-custody users, marketed for its air-gapped security design — making the scale of the theft particularly notable within the hardware wallet segment.

The research firm published its findings on Monday in a post on X (Twitter):

🚨LOSSES FROM COLDCARD HACK EXCEED $100M High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents. If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC). More in the thread below 👇 pic.twitter.com/RAl3ib67qa — Galaxy Research (@glxyresearch) August 3, 2026

Galaxy also identified 14 smaller security incidents connected to the same seed-generation flaw, expanding the confirmed scope of the exploit.

Why Galaxy Excluded the Fourth Wave

Galaxy has not yet incorporated the suspected fourth wave into its confirmed total, citing insufficient verification from affected wallet owners. The firm is awaiting additional victims to come forward and validate the related addresses, which remain classified under its suspected tally.

Blockchain activity nonetheless points to another coordinated theft wave. Galaxy assesses with medium-high confidence that a single attacker likely accounted for a substantial share of the suspected activity.

Alex Thorn, Galaxy's head of firmwide research, first flagged the potential fourth wave on August 3. The observed transactions bore similarities to those in the previous three waves. Thorn estimated that 448.7 BTC were stolen from 709 probable victim addresses. Galaxy did not include that figure in its confirmed total.

How Galaxy Tracks the Exploit

According to Galaxy, on-chain analysis has inherent limitations in evaluating the Coldcard exploit. On-chain evidence cannot always confirm every suspected victim, nor can it establish that a single individual was responsible for each theft.

Galaxy's research team continues to refine its address map using newly acquired data. Investigators review information supplied directly by wallet owners as well as data from other participants in the investigation.

The vulnerability affects seeds generated by the following Coldcard models: Mk3, Mk4, Mk5, and Coldcard Q. Every compromised wallet was running one of the vulnerable firmware versions.

Coinkite, the manufacturer of Coldcard, disclosed the exploit last week. The company traced the problem to work completed in March 2021 during the integration of a new cryptographic library. That timeline means affected devices may have been generating vulnerable seeds for roughly five years before disclosure — a long detection window that highlights the difficulty of auditing entropy generation in hardware wallet firmware, since seeds that appear random can still be predictable if the underlying entropy pool is insufficient.

Technical Details and User Guidance

The firmware had relied on a deterministic pseudo-random number generator supplied by MicroPython for wallet seed generation, rather than the intended hardware-backed random number generator. The hardware generator continued operating in other parts of the firmware, and reviews confirmed the component existed within the system, but the seed-generation error went undetected.

Coinkite estimated that Mk2 and Mk3 devices could generate as few as 40 bits of entropy, while vulnerable Mk4, Mk5, and Coldcard Q models could produce up to 72 bits. The intended entropy level was 128 bits. Entropy at those reduced levels is considered cryptographically weak, as lower-bit seeds can be brute-forced far more efficiently than properly generated ones — a class of vulnerability that has affected other cryptocurrency systems in the past.

Galaxy stated that the Coldcard exploit remains active. The firm advised affected users to transfer funds to safer addresses and to create entirely new wallet seeds on patched devices.