Coldcard Exploit Spirals to $88M as Third Wave of Bitcoin Thefts Accelerates

Galaxy Research is reporting a grim escalation in the ongoing Coldcard Bitcoin wallet compromise. The exploit has now ballooned to approximately 1,367 BTC stolen across 4,585 addresses—translating to roughly $88 million at current valuations. What started as an isolated incident has morphed into a sustained drain on compromised wallets, with attackers executing a third wave of coordinated thefts.

The Growing Scale of the Problem

We're watching this situation unfold in real time, and the numbers are getting worse. The initial reports focused on a smaller subset of compromised Coldcard devices, but Galaxy Research's latest analysis shows the breach extends far beyond early estimates. The fact that over 4,500 addresses are affected tells us this isn't a one-off attack on a few high-net-worth holders—it's a systematic vulnerability that's being actively exploited.

The progression through multiple theft waves suggests the attackers aren't just grabbing what's immediately available and moving on. Instead, they're methodically working through their list of compromised wallets, likely coordinating timing to maximize impact while evading immediate detection. This disciplined approach indicates sophisticated actors with both technical expertise and operational planning.

What This Means for Bitcoin Security

For the crypto analysis community, this is a wake-up call about hardware wallet vulnerabilities. Coldcard devices have long been regarded as among the most secure options for Bitcoin storage—the irony isn't lost on us. Yet here we have a supply chain or firmware issue that's bypassed what many considered to be fortified defenses.

The portfolio implications are serious. Investors who believed their Bitcoin was safely locked away in hardware wallets are discovering that's not an absolute guarantee. This exploit demonstrates that security is only as strong as the weakest link in the chain, whether that's manufacturing, firmware updates, or the initial device configuration.

Attackers Continue Operating

The critical concern right now is that the bleeding hasn't stopped. With three waves already documented, there's no indication the attackers have slowed their activity. Each new wave represents fresh Bitcoin leaving the market from these addresses, which could apply downward pressure on sentiment around hardware wallet safety—a crucial pillar of long-term crypto storage strategy.

The fact that Galaxy Research is tracking this in discrete waves tells us they're monitoring the blockchain closely for patterns. What we're likely seeing is attackers prioritizing targets by wallet size or other factors, which means smaller holders might not yet realize their wallets have been compromised.