Galaxy Research has identified more than 8,680 addresses tied to a Coldcard exploit that began on July 30, with total Bitcoin losses surpassing $115 million. The investigation, based on interviews with over 200 victims on August 16, traced compromised coins to vulnerable firmware released on March 17, 2021, at block height 674,951. The attack exploited a seed-generation flaw that allowed illicit actors to predict wallet seed entropy. Approximately 1,790 addresses and 714.8 Bitcoin were linked to 192 victims, though the broader theft set holds about 1,778.6 BTC. The largest concentration of stolen addresses dates to between 2021 and 2022.
An exploit targeting Coldcard hardware wallets has surpassed $115 million in losses, according to Galaxy Research. The firm spoke with more than 200 victims on August 16 to understand the intelligence behind the attack.
The compromised coins were produced on the day a vulnerable Coldcard firmware was released. That release happened on March 17, 2021, when Bitcoin reached block height 674,951.
Researchers linked the attack to a seed-generation flaw. In such cases, illicit actors typically predict or forge the stolen wallet seed entropy.
Galaxy Research‘s published theft set includes 8,680 addresses holding approximately 1,778.6 BTC. Only a small percentage of these addresses have been directly connected to victims who reported losses.
All 192 individuals interviewed reported losses involving addresses in the public dataset, which includes roughly 1,790 addresses and 714.8 Bitcoin. The largest concentration of stolen addresses dates to between 2021 and 2022.
Investigators identified several “fingerprints” based on transaction behavior, including block timing, fees, lock times, RBF/sequence settings, transaction structure, and destination addresses.
Wave 1 stole roughly 1,082.65 BTC from blocks 960,183–960,191, moving one victim per transaction into four collection addresses. Wave 3 managed 63 victims, while Wave 2 handled 19.
Footprint E batched up to 795 victims per transaction, with a median of 118. Destination patterns also differed, as some groups dispersed funds over hundreds of locations while others concentrated them into a few addresses.
