Coldcard | Crypto

Galaxy said 82% of Bitcoin stolen across all Coldcard attacks remains in the original addresses, with 18% moved in apparent laundering. The exploiter behind the third wave of the Coldcard wallet hack has moved about 45% of their Bitcoin (BTC) haul, routing the funds through THORChain or into CoinJoin transactions, according to Galaxy Research. In a Monday update, Galaxy said the exploiter began moving funds to Ethereum through THORChain on Sept. 2. The latest movements sent Bitcoin into CoinJoin rounds, which combine multiple users’ payments into a single transaction to make funds harder to trace. Galaxy said the third-wave exploiter had created 293 two-of-two multisignature vaults to hold victims’ coins and was moving funds from the largest vaults in descending order of size. Funds from the 11 largest vaults have now been moved. Read more

The attacker has now drained the 11 largest vaults tied to the third wave of Coldcard thefts, Galaxy Research said.

The third-wave Coldcard exploiter moved about 10% of stolen funds through THORChain as researchers traced the assets to a new Ethereum address. A hacker linked to the third wave of Coldcard wallet thefts has started swapping stolen Bitcoin for Ether through THORChain. Galaxy head of research Alex Thorn took to X on Wednesday to report that the third-wave exploiter moved about 10% of the stolen funds, with 90% remaining untouched. Thorn said it marked the first time funds from any of the three waves had moved onchain from the original hacker addresses. “The hacker appears to be having some issues swapping all the funds through THORChain — they keep getting refunded and he keeps retrying,” he said. Read more

Galaxy Research’s latest tally shows that more than half of 221 Coldcard hack victim reports involved individual losses exceeding 1 Bitcoin. The vast majority of Bitcoin stolen in the Coldcard hack remains unmoved, according to researchers tracking one of the largest hardware wallet exploits. Galaxy Research has attributed the theft of 1,789.28 Bitcoin from 8,865 addresses to the Coldcard hack, according to a Monday X post by Alex Thorn, Galaxy’s head of research. The funds were worth $114.7 million at the time of theft. Thorn said attackers have not spent 1,561 Bitcoin, or 87.3% of the attributed losses. The funds remain in attacker-controlled collection or holding addresses, including all Bitcoin stolen during the first three attack waves. Read more

Firmware 5.6.1 and 1.5.1Q harden new wallet creation but cannot repair a seed made on an affected release. The post Coldcard now requires 65 key presses after seed exploit, while exposed funds still must move appeared first on CryptoSlate.

Coinkite urged Coldcard users to generate new seed phrases, warning that existing vulnerable seeds remain unsafe despite the security upgrade. Coinkite released a new security upgrade to strengthen seed phrase generation by requiring user-supplied entropy mixed with improved device randomness. Coinkite announced firmware 5.6.1 for Coldcard Mk4 and Mk5 devices and 1.5.1Q for the Coldcard Q in a Thursday blog post. The release requires newly generated seeds to include user-supplied entropy through at least 65 keypresses with unpredictable timing, 50 rolls of a six-sided die or 128 coin flips. That input is combined with randomness from multiple device sources, including its secure elements and hardware random-number generator (RNG). Read more

Crypto’s favorite maxim, “don’t trust, verify” wasn’t followed in the case of Coldcard’s code.

The Coldcard hack has no definitive loss figure yet as investigators rely on victim reports and onchain analysis that produce varying estimates. The Coldcard hack is testing crypto investigators’ ability to measure losses from self-custody wallets, where victim reports are critical to establishing the scale of the theft. Blockchain analytics platform CryptoQuant currently puts confirmed losses at 1,432 Bitcoin, while other analysts have traced substantially more funds to the attack. Galaxy Research and blockchain intelligence company TRM Labs both say their analysis points to a higher toll, while distinguishing between losses directly confirmed by victims and funds attributed to the attack through onchain patterns. Read more

The Coldcard exploit, which caused more than $100 million in losses, helped push July crypto thefts to $247 million, making it the second-worst month of 2026. July emerged as the second-worst month of 2026 for cryptocurrency thefts, largely due to the recent Coldcard exploit. Hackers stole $247.4 million in crypto in July, the most this year after the $644 million stolen in April, according to DefiLlama data. The total was more than triple the $75 million stolen in June and the $60 million stolen in May. The Coldcard exploit was the month’s biggest exploit, with at least $100 million in Bitcoin (BTC) stolen from 7,300 wallets across three confirmed attack waves, according to Galaxy Digital. The company also identified a suspected fourth wave that could bring total losses to about $130 million. DefiLlama’s hack tracker estimates losses tied to the Coldcard exploit at $115 million. Read more

A week-long streak of inflows into US spot Bitcoin ETFs has coincided with the Coldcard wallet exploit, fueling debate over whether some investors are shifting away from self-custody. Demand for US spot Bitcoin exchange-traded funds (ETFs) has accelerated over the past week, with a string of daily inflows coinciding with the Coldcard wallet hack — timing that has prompted speculation about whether some investors are reconsidering self-custody. According to Bloomberg senior ETF analyst Eric Balchunas, BlackRock’s iShares Bitcoin Trust (IBIT), Fidelity Wise Origin Bitcoin Fund (FBTC), Bitwise Bitcoin ETF (BITB), ARK 21Shares Bitcoin ETF (ARKB) as well as Defiance Daily Target 2X Long MSTR ETF (MSBT) have recorded inflows every trading day since the weekend exploit, totaling roughly $620 million. The cumulative figure is consistent with Cointelegraph’s recent reporting on the ETF inflow streak. The Coldcard exploit drained more than $116 million worth of Bitcoin from over 5,200 wallet addresses, according to blo...

Hackers behind the Coldcard exploit transferred millions in digital assets to cryptocurrency mixers, while most stolen funds remained traceable in attacker-controlled wallets. About 64 Bitcoin, worth $4.17 million, and 200 Ether, worth $380,000, linked to the recent Coldcard exploit were sent to cryptocurrency mixing protocols, according to blockchain security platform CertiK.  The Bitcoin transfer was from address bc1q0 to crypto mixing protocol Wasabi on Tuesday, according to blockchain data shared by CertiK. “We think it might be a smaller exploiter. There’s likely a few copycats after the initial exploit,” a CertiK spokesperson told Cointelegraph. The 200 Ether (ETH) was transferred to Tornado Cash on Wednesday, according to CertiK’s X post. Read more

The Coldcard entropy flaw caused a crisis of confidence in hardware wallets. Here’s the details you need to know before you entrust Ledger, Trezor or Foundation with your Bitcoin. Just when you thought crypto market morale couldn’t sink any lower, along comes the Coldcard entropy bug to prove you wrong. The discovery of a flaw in one of the industry’s longest-running hardware wallets last Friday serves as a stark reminder that there is no perfectly safe place to put all your Bitcoin. Coldcard disclosed the entropy-generation flaw affecting multiple Coldcard devices on July 31. Since then, researchers at Galaxy Digital say attackers have been able to steal more than 1,596 Bitcoin worth at least $100 million through several coordinated attacks. Read more

The Coldcard hardware wallet exploit has resulted in the theft of at least 1,596 BTC from about 7,300 addresses as users continue moving funds from potentially vulnerable wallets. Galaxy Research said the confirmed losses came from three major attack waves and 14 smaller incidents. The firm has also identified a possible fourth wave that could […] The post Coldcard’s $130 million crisis is pushing Bitcoin back into Wall Street’s hands appeared first on CryptoSlate.

Galaxy said that at least 15 different attackers have exploited the Coldcard vulnerability, which may have been avoided with just $2 worth of AI hardening, according to Dragonfly’s managing partner. At least 15 different attackers have exploited the Coldcard vulnerability, according to Galaxy Digital’s head of research, Alex Thorn, citing new victim reports received since the incident. Thorn said Tuesday that the victim reports helped the company label new attackers that would have gone undiscovered, as the nature of the exploit was different from a hack on a centralized exchange.  “Due to one single victim’s report of less than 1 BTC stolen, we identified a new attack with 12 BTC siphoned from 126 addresses,” Thorn wrote in a Tuesday X post. Read more

Bitcoin advanced as the market settled down following the weekend’s hack of Coldcard wallets and sales by Strategy even as sentiment remained in “extreme fear.”

Block's Bitcoin Engineering and Security team and independent Bitcoin Core developers have traced the recent batch of Coinkite Coldcard wallet losses to a specific firmware defect that exposed a hidden weakness in Bitcoin self-custody before any user touched a seed phrase. The bug diverted the device's random-number generation from its STM32 hardware source to MicroPython's […] The post Coldcard crisis hits $130 million – proving ‘not your keys’ is meaningless if you trust a single device to generate them appeared first on CryptoSlate.

The five-year bug escaped detection because auditors verified that the intended random number generator existed, but not that it was being called. Coldcard’s five-year seed-generation flaw has exposed a broader weakness in how hardware wallets are independently tested, according to Kraken chief security officer Nick Percoco.  In an X post on Sunday, Percoco said the incident should be a “wake-up call” for hardware-wallet makers, calling for independent testing to verify that the approved source of randomness is the one actually used by production firmware.  “Consumers are asked to trust a manufacturer’s implementation of the single most critical function in the system, with no independent verification that the approved entropy path is the one actually executing,” said Percoco.  Read more

Galaxy research head Alex Thorn warned that unconfirmed transactions may give some Coldcard users a narrow opportunity to save their funds. Update (Aug. 3 at 4:19 am UTC): This article has been updated with the latest estimated number of affected addresses and Bitcoin from Galaxy’s Alex Thorn. Coldcard users are being warned of a new wave of coordinated thefts targeting their Bitcoin hardware wallets, coming just days after the first wave of attacks on Thursday. In an X post on Monday, Galaxy research head Alex Thorn flagged hundreds of transactions impacting 709 potential victim addresses, moving around 448.7 Bitcoin (BTC). Read more

The “sickening” loss of $90 million of Bitcoin from cold storage weighs heavily on sentiment, as the Clarity Act stalls with just five days left to hold a Senate vote. After $90 million in Bitcoin was drained from Coldcard wallet users, small hodlers desperately sought refuge on centralized exchanges and via alternative custody methods. Bitcoin transfers below 1 BTC climbed to their highest daily level since 2022 on Friday, with 39,600 BTC moved, according to data shared by CryptoQuant head of research Julio Moreno on Saturday. The figure was just 300 BTC below the 39,900 BTC transferred on Nov. 16, 2022, days after FTX filed for bankruptcy. Galaxy Research, the research arm of crypto investment company Galaxy Digital, reported Saturday that the third wave of attacks on users of the hardware wallet on the weekend brought estimated losses to 1,367 BTC ($88.6 million) across 4,585 addresses. Read more

Coldcard’s wallet crisis has shaken Bitcoin sentiment, blurred on-chain signals and exposed a recurring weakness in AI-assisted cyber defenses. On July 30, hardware maker Coinkite warned users that wallets generated with affected Coldcard firmware could be drained because a software error produced seed phrases with far less randomness than intended. This security incident, Galaxy Research […] The post Coldcard’s $89M wallet bug triggers the biggest Bitcoin movement since FTX and completely distorts market signals appeared first on CryptoSlate.