Coldcard Hackers Strike Again, Losses Soar Past $100M

A major hardware wallet breach has left investors reeling after losses surpassed $100 million. The exploit, linked to Coldcard, has grown in scope as investigators identify more affected addresses.

Initially, findings suggested that 4,585 addresses were compromised in three waves, resulting in the theft of approximately 1,367 Bitcoin worth around $88.6 million. However, further investigation revealed an additional 1,912 affected addresses, increasing losses by 207.73 BTC and indicating that all stolen coins remained unspent.

The total confirmed losses now exceed 1,596 BTC, valued at over $100 million across roughly 7,300 addresses. Galaxy Research identified 14 smaller related incidents, pushing suspected losses towards nearly $130 million. This exploit highlights one of the most significant failures in Bitcoin's custody security and raises broader questions about the resilience of hardware wallets.

The blockchain data has strengthened the investigation, revealing that 90% of stolen Bitcoin remains untouched. Each coin transferred through Waves 1, 2, and 3 sits in its receiving addresses, solidifying investigators' confidence in mapping attacker-controlled wallets and identifying additional linked addresses.