Galaxy estimates Coldcard exploit may have stolen up to 2,055 Bitcoin

cryptonews08-04 14:40

Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2656580701?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-08-04 14:40","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2656580701","market":"sh","top_or_hot":-1,"title":"Galaxy estimates Coldcard exploit may have stolen up to 2,055 Bitcoin","media":"cryptonews","content":"<div>\n<p>Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130...</p>\n\n<a href=\"https://crypto.news/galaxy-estimates-coldcard-exploit-may-have-stolen-up-to-2055-bitcoin/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Galaxy estimates Coldcard exploit may have stolen up to 2,055 Bitcoin</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nGalaxy estimates Coldcard exploit may have stolen up to 2,055 Bitcoin\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-04 14:40 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/galaxy-estimates-coldcard-exploit-may-have-stolen-up-to-2055-bitcoin/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130...</p>\n\n<a href=\"https://crypto.news/galaxy-estimates-coldcard-exploit-may-have-stolen-up-to-2055-bitcoin/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"DFII","symbol_name":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","start_time":0,"source_url":"https://crypto.news/galaxy-estimates-coldcard-exploit-may-have-stolen-up-to-2055-bitcoin/","article_id":"2656580701","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/galaxy-estimates-coldcard-exploit-may-have-stolen-up-to-2055-bitcoin/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2656580701","pubTimestamp":1785825611,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130 million, if a suspected fourth wave is verified.Galaxy Research said in a post published Monday on X that it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, along with 14 smaller security incidents linked to the Coldcard seed-generation flaw.The research firm said its latest estimate excludes a fourth suspected attack wave because it has not yet received enough confirmation from affected wallet owners. If the additional activity is validated, the total would rise to 2,055 BTC, valued at about $130 million at current prices.Earlier blockchain analysis from Galaxy had estimated roughly 1,815.75 BTC moving across four observed waves, but the firm emphasized at the time that the figures came from on-chain analysis rather than confirmed victim repo","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","BTCC":"Grayscale Bitcoin Covered Call ETF","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","BTCI":"NEOS Bitcoin High Income ETF","BPI":"Grayscale Bitcoin Premium Income ETF","GBTC":"比特币ETF-Grayscale","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","BTF":"比特币&以太币期货ETF-CoinShares","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","BITX":"2倍比特币期货ETF-Volatility Shares","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BRRR":"比特币ETF-CoinShares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","BETE":"等权重比特币&以太币期货ETF-ProShares","BTFX":"比特币期货ETF-CoinShares","YBTC":"比特币看涨期权ETF-Roundhill","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","BETH":"比特币&以太币期货ETF-ProShares","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BTCO":"比特币ETF-Invesco Galaxy","EZBC":"比特币ETF-Franklin","BITB":"比特币ETF-Bitwise","FBTC":"比特币ETF-Fidelity","SBIT":"2倍做空比特币期货ETF-Proshares","MAXI":"比特币期货ETF-Simplify","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BITI":"1倍做空比特币期货ETF-Proshares","BTRN":"比特币期货ETF-Global X","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BK4594":"比特币ETF概念","BTCW":"比特币ETF-Wisdom Tree","ARKB":"比特币ETF-21Shares","BITO":"比特币期货ETF-ProShares","IBIT":"比特币ETF-iShares","BK4601":"加密货币现货ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","HODL":"比特币ETF-VanEck","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","BCCC":"Global X Bitcoin Covered Call ETF","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","DEFI":"比特币期货ETF-Hashdex","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","BTC":"Grayscale Bitcoin Mini Trust","BITU":"2倍做多比特币期货ETF-Proshares"},"translate_title":"银河估计冷卡漏洞可能窃取了多达 2,055 个比特币","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"GBTC":0.6,"CBTJ":0.6,"BTCI":0.6,"BPI":0.6,"CBOO":0.6,"BTCL":0.6,"EZBC":0.6,"CBTY":0.6,"DEFI":0.6,"DFII":0.6,"QBF":0.6,"HODL":0.6,"MNRS":0.6,"BAGY":0.6,"CBXA":0.6,"BTCZ":0.6,"XBTY":0.6,"CBXO":0.6,"CBOJ":0.6,"CBTA":0.6,"BFAP":0.6,"BITY":0.6,"BITX":0.6,"CBXY":0.6,"BITU":0.6,"BITI":0.6,"ARKB":0.6,"BITB":0.6,"CBOA":0.6,"CBOY":0.6,"BTFX":0.6,"CBXJ":0.6,"CBTO":0.6,"BFJL":0.6,"BCCC":0.6,"YBTC":0.6,"BRRR":0.6,"BETH":0.6,"BTCC":0.6,"MAXI":0.6,"BITO":0.6,"BTRN":0.6,"BTCO":1.79,"FBTC":0.6,"IBIT":0.6,"BTF":0.6,"SBIT":0.6,"BETE":0.6,"BTC":1.95,"BTCW":0.6},"content_text":"Galaxy Research has estimated that losses tied to the Coldcard hardware wallet vulnerability have reached 1,596 Bitcoin across confirmed attack waves and could climb to about 2,055 BTC, or nearly $130 million, if a suspected fourth wave is verified.\n\n\nSummary\n\n\n\nGalaxy Research estimates confirmed Coldcard related thefts have reached 1,596 Bitcoin across three attack waves.\nThe research firm says losses could rise to about 2,055 Bitcoin worth nearly $130 million if a suspected fourth wave is confirmed.\nInvestigators have shared confirmed attacker and victim addresses with U.S. law enforcement agencies, exchanges and cyber investigation groups.\nAround 90% of the stolen Bitcoin remains unmoved while affected Coldcard users are urged to generate new wallet seeds and migrate their funds.\n\n\n\nGalaxy Research said in a post published Monday on X that it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, along with 14 smaller security incidents linked to the Coldcard seed-generation flaw.\n\n🚨LOSSES FROM COLDCARD HACK EXCEED $100M High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents. If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).More in the thread below 👇 pic.twitter.com/RAl3ib67qa— Galaxy Research (@glxyresearch) August 3, 2026\n\nThe research firm said its latest estimate excludes a fourth suspected attack wave because it has not yet received enough confirmation from affected wallet owners. If the additional activity is validated, the total would rise to 2,055 BTC, valued at about $130 million at current prices.\nEarlier blockchain analysis from Galaxy had estimated roughly 1,815.75 BTC moving across four observed waves, but the firm emphasized at the time that the figures came from on-chain analysis rather than confirmed victim reports. The latest update narrows confirmed losses while keeping the larger estimate tied to the still-unverified fourth wave.\nColdcard attack investigation remains active\nGalaxy said it has identified what it believes is a fourth coordinated wave of theft but is still waiting for victim confirmation before adding those addresses to its confirmed tally.\nAccording to the research firm, blockchain activity suggests the suspected fourth wave is “substantially comprised of” one attacker, giving analysts medium-high confidence in that assessment despite the remaining uncertainty over affected wallets.\nAlex Thorn, Galaxy’s head of firmwide research, first flagged the potential fourth wave on Aug. 3 after identifying transaction patterns that closely matched the earlier attacks. His running estimate later rose to 448.7 BTC moving from 709 potential victim addresses, although Galaxy stressed that blockchain data alone cannot confirm every victim or determine whether a single operator carried out every theft.\nThe firm added that its investigators continue refining address mapping as additional information becomes available from wallet owners and other participants in the investigation.\nColdcard flaw dates back to 2021 firmware change\nThe attacks stem from a vulnerability affecting seeds generated on Coldcard Mk3, Mk4, Mk5 and Coldcard Q devices running vulnerable firmware versions.\nCoinkite disclosed last week that the flaw originated in March 2021 while integrating a new cryptographic library into its firmware. Instead of generating wallet seeds through the intended hardware-backed true random number generator, affected firmware mistakenly relied on a deterministic pseudo-random generator provided by MicroPython.\nAccording to Coinkite’s technical review, the hardware random-number generator remained active elsewhere in the firmware, allowing internal reviews to confirm its presence without revealing that wallet creation had switched to a different entropy source.\nBlock’s Bitcoin engineering and security team independently reached the same conclusion after reviewing the firmware. While the company said it had not completed full empirical testing of every affected device, it concluded that the vulnerable firmware called the deterministic MicroPython fallback instead of the STM32 hardware random-number generator during seed creation.\nCoinkite estimates that affected Mk2 and Mk3 devices may provide roughly 40 bits of effective entropy, while vulnerable Mk4, Mk5 and Coldcard Q models may generate about 72 bits instead of the intended 128 bits.\nMost stolen Bitcoin has not moved\nGalaxy said investigators have been working with U.S. federal law enforcement agencies, cryptocurrency exchanges and cyber investigation groups by sharing confirmed attacker and victim addresses as the investigation expands.\nThe research firm reported that approximately 90% of the stolen Bitcoin remains untouched. It added that none of the coins stolen during the first three confirmed attack waves have moved since they were taken, giving investigators additional time to monitor the funds.\nGalaxy also warned that new attackers could attempt to exploit the same vulnerability while affected devices remain in use. For that reason, it said identifying additional attacker-controlled addresses remains important so exchanges and authorities can respond if funds begin moving.\nEarlier blockchain analysis showed attack activity accelerating to about 13.8 wallet sweeps per Bitcoin block during the fourth suspected wave, compared with roughly 0.3 sweeps per block before the incident. Galaxy also observed that most stolen balances were transferred to newly created addresses instead of one central collection wallet, while some funds later moved through second-hop transactions that complicated blockchain tracing.\nThe firm previously noted that users who still control compromised wallets may have a limited opportunity to replace an unconfirmed theft transaction with a higher-fee transaction under Bitcoin’s Replace-by-Fee mechanism, although the option only exists before miners confirm the original transaction and offers no guarantee of recovery.\nColdcard users are still urged to replace wallet seeds\nGalaxy said the attacks remain active and advised affected Coldcard users to move their funds to secure addresses and create entirely new wallet seeds on patched devices.\nCoinkite has already released emergency firmware updates for every affected product, including version 4.2.0 for Mk2 and Mk3 devices, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for Coldcard Q, and Edge releases 6.6.0X and 6.6.0QX. The company has also destroyed all remaining inventory containing vulnerable firmware.\nAccording to Coinkite, installing updated firmware protects only wallets created after the fix. Existing seed phrases generated with vulnerable firmware remain exposed and should be replaced.\nThe company recommends generating a completely new seed after updating the device, verifying a receiving address, sending a small test transaction, and transferring the remaining balance only after confirming the test succeeds.\nCoinkite also said wallets created using at least 50 fair private dice rolls are not exposed by this random-number-generation issue alone. While a strong BIP-39 passphrase adds another security layer, the company continues to recommend migration because the original vulnerable seed remains weak.\n\n\n\n\n\n                Read more:\n            \n\n                Boltz halts swaps as AI attacks outpace its team","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.1","shortVersion":"4.47.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2656580701","isCrawlerRequest":true}