Coldcard Hack Surpasses $100M: Three Confirmed Attack Waves Leave Bitcoin Community Reeling

Galaxy Research is tracking a devastating series of Coldcard compromises that have now exceeded $100 million in stolen Bitcoin across three confirmed attack waves. What's particularly striking here is that 90% of the stolen Bitcoin remains completely unmoved—a telltale sign that attackers may be laying low while law enforcement and security researchers close in.

The timing matters. This isn't some isolated incident; investigators are actively examining evidence of a suspected fourth wave that could potentially push total losses to $130 million. That's real money, and it's forcing the crypto community to confront uncomfortable questions about hardware wallet security.

The Unmoved Bitcoin Factor

The fact that 90% of stolen funds remain stationary in wallets is significant for crypto analysis. Typically, sophisticated attackers quickly move or tumble funds to obscure their tracks. This hesitation suggests either operational caution or a deliberate holding strategy—potentially waiting for market conditions to shift or for the heat to die down before liquidating positions.

For portfolio holders who use Coldcard devices, this creates an extended window of uncertainty. Every stationary Bitcoin linked to these attacks represents a potential future liquidity event that could apply downward pressure on markets.

Investigating Wave Four

Galaxy's identification of a suspected fourth wave underscores how these attacks may not have concluded. If confirmed, the jump from $100M to $130M would represent a 30% increase in total damage—a material swing that demands attention from both institutional and retail traders.

The investigation phase is crucial for crypto intelligence. Understanding the attack vectors, timing between waves, and compromised device batches helps the broader ecosystem implement defensive measures. It also helps clarify whether this represents a supply chain vulnerability, a firmware exploit, or something targeting specific user cohorts.

What This Means for Trading and Risk Management

For active traders and long-term holders alike, the Coldcard situation is a reminder that hardware wallet security requires constant vigilance. The stolen Bitcoin remaining dormant creates both risk and opportunity—risk because sudden movements could trigger liquidation cascades, opportunity because the extended timeline gives exchanges and protocols time to implement detection and blocking mechanisms.

We're also watching how this impacts Bitcoin's credibility narrative. Hardware wallets have long been positioned as the gold standard for security-conscious investors. Three confirmed attack waves demand a serious reassessment of both Coldcard's security posture and the broader hardware wallet market.