Galaxy Estimates Coldcard Losses May Top $130 Million

Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across three confirmed attack waves and could climb to about 2,055 BTC, or nearly $130 million, if a suspected fourth wave is verified.

The attacks stem from a vulnerability affecting seeds generated on Coldcard Mk3, Mk4, Mk5, and Coldcard Q devices running vulnerable firmware versions. The flaw originated in March 2021 when Coinkite integrated a new cryptographic library into its firmware, causing affected firmware to mistakenly rely on a deterministic pseudo-random generator instead of the hardware-backed true random number generator.

Galaxy Research said that approximately 90% of the stolen Bitcoin remains untouched. It added that none of the coins stolen during the first three confirmed attack waves have moved since they were taken, giving investigators additional time to monitor the funds.