15+ Attackers Exploit Coldcard Wallet Vulnerability, Estimated Losses Reach $100M

At least 15 attackers have exploited a vulnerability in Coldcard wallets, resulting in estimated losses of $100 million across three confirmed attack waves, according to Galaxy Digital's head of research Alex Thorn. The company identified new victim reports that helped label additional attackers who would have gone undiscovered.

The nature of the exploit was different from a hack on a centralized exchange, Thorn noted. One single victim's report of less than 1 BTC stolen revealed a new attack with 12 BTC siphoned from 126 addresses.

Galaxy Research estimated losses could reach $130 million in Bitcoin if a suspected fourth wave is confirmed.

Roughly $2 worth of AI hardening could have prevented the exploit, according to Dragonfly managing partner Haseeb Qureshi. He cited social media reports that some AI models rediscovered the vulnerability in less than 20 minutes.