Coldcard Exploit Swipes $88.6M in Bitcoin as Researchers Warn of Ongoing Threat

The ongoing Coldcard exploit has resulted in the theft of approximately $88.6 million in Bitcoin, with researchers tracking losses across 4,585 addresses in three waves.

Galaxy Research's Alex Thorn described the sweeps as deliberate and likely orchestrated by a large language model, warning that every single-sig Coldcard address created after the March 2021 firmware flaw will eventually be drained.

The breach has led to an unusual reversal of the 'not your keys, not your coins' ethos, with users moving Bitcoin back to exchanges in an effort to secure their funds.

Galaxy Research has flagged over 600 suspected attacker addresses to federal investigators and compliance firms, crediting victims who shared transaction details for helping map on-chain patterns.

A Canadian coach, Jonathan Goodman, reported losing $1.6 million in Bitcoin despite taking precautions to keep his keys secure, highlighting the severity of the exploit.