Coldcard Users Did Everything Right and Still Lost $111M

Galaxy documented the exploitation as a series of theft waves. The confirmed losses run between about 1,596 BTC and 1,719 BTC. Three confirmed waves preceded a suspected fourth around Aug. 3 that added roughly 389 BTC. The fourth wave arrived after both the disclosure and the patched release. By Aug. 7, confirmed stolen Bitcoin stood at 1,719 BTC. Some reports put potential total losses above $130 million once additional suspected activity was included.

Galaxy read the sequence as coordinated exploitation rather than one opportunistic actor who found the bug independently. Galaxy's identification of at least 15 distinct attackers suggests the vulnerability was shared or sold among a group before public disclosure.

Most of the stolen Bitcoin remains unspent on-chain. Thorn said the attackers have moved the funds without converting or dispersing them through typical laundering patterns. The coins sit outside exchanges and mixers. Thorn said that could change at any time.

Hardware wallets sell on one promise: keys offline, Bitcoin safe. Coldcard's reputation rested on being among the most security-conscious devices available. Its users skew toward technically sophisticated Bitcoin holders who chose self-custody over exchange storage.

The people most committed to controlling their own keys ended up exposed by the tool they trusted to protect those keys.

Any Coldcard running firmware 4.0.1 or later carries the exposure, including devices updated in the five years since the bug shipped. For users still holding funds on those versions, the next step is to update the firmware and migrate to a freshly generated seed. Waiting adds risk. Galaxy said the suspected fourth wave suggests the exploitation window may still be open for affected addresses that have not been drained.

Coinkite has not said whether affected users were notified individually before the July 30 disclosure and has not responded to requests for comment.