Coldcard Security Breach Could Balloon to $130M as Fourth Attack Wave Looms

The Coldcard hardware wallet hack is shaping up to be worse than initially feared. Galaxy Research just flagged a critical concern: current loss estimates only account for three confirmed attack waves, but evidence suggests a fourth wave may be incoming—potentially swelling total damages to $130 million.

Here's what we're tracking. Coldcard, one of the most trusted Bitcoin custody solutions for serious traders and institutions, suffered a supply chain compromise that exposed private keys to attackers. The breach hit multiple customer cohorts in successive waves, each uncovering new victims and larger aggregate losses.

Galaxy's analysis, shared via X, zeroed in on the math. Three waves of confirmed attacks have already resulted in significant Bitcoin theft. But the research team suspects the losses to be "greater once the yet-unconfirmed fourth wave of attacks is included." That fourth wave hasn't been officially verified, but the pattern and evidence pointing to its existence is hard to ignore.

For crypto investors managing Bitcoin holdings or diversified portfolios, this matters. Hardware wallets like Coldcard are supposed to be the gold standard for self-custody—the hardened alternative to exchange wallets or software solutions. A compromise at this scale forces serious questions about supply chain security across the hardware wallet industry.

The Damage Assessment

The $130 million figure represents cumulative losses across all identified waves. That's not small change, even in a crypto market that's accustomed to nine-figure hacks. The fact that Galaxy is specifically flagging an unconfirmed fourth attack suggests they're seeing forensic trails or on-chain data pointing to additional compromised devices still moving stolen Bitcoin.

This ties into broader market intelligence about Coldcard's customer base. The wallet attracts serious Bitcoin holders—seasoned traders, institutional players, and high-net-worth individuals who prioritize security. Those users typically hold meaningful amounts, which explains why even a limited number of compromised devices could result in eight-figure losses.

What This Means for Hardware Wallet Security

The Coldcard incident isn't just a Coldcard problem. It's a hardware wallet market problem. If a supply chain vulnerability can expose private keys at scale, similar risks likely exist elsewhere. Ethereum and other crypto assets secured via compromised hardware also face exposure, depending on wallet configuration.

Galaxy's ongoing analysis—waiting for confirmation of that fourth wave—reflects the reality of incident response in crypto. Unlike traditional finance where losses are often contained and quantified quickly, blockchain-based theft is transparent but delayed. Losses appear on-chain gradually as attackers move stolen crypto through mixers, exchanges, or other infrastructure.