Galaxy Traces $114.7M in Stolen BTC from Coldcard Exploit

Galaxy Research has mapped 1,789.28 BTC, worth $114.7 million, stolen across 8,865 addresses in the ongoing Coldcard hardware wallet exploit, with 87.3% of the funds, roughly 1,561 BTC, still sitting in attacker-controlled addresses. Alex Thorn, Head of Research at Galaxy, published the updated tally on 25 August 2026, noting that no Bitcoin from the first three attack waves has been moved or laundered since the initial sweep in late July.

Four Attack Waves Since Late July

The exploit targets a firmware vulnerability introduced in March 2021 that compromised the entropy used to generate private keys on Coldcard devices. Galaxy Research identified four distinct attack waves, and the first wave on 30 July 2026 drained 1,082.65 BTC from 1,196 addresses in a 41-minute window, with every sweep paying an identical 30.0 sat/vB fee. Subsequent waves on 31 July, 2 August, and 3 August added a further 706.63 BTC from the remaining affected addresses.Galaxy's analysis of 221 victim reports covering 790.72 BTC, or 44.2% of total losses, found a median loss of 1.04272 BTC per report. The affected addresses had an average dormancy period of 3.18 years before the funds were swept, indicating the stolen Bitcoin was held in long-term cold storage by holders who believed their keys were secure.

Recovery Prospects Hinge on Unmoved Funds

"The funds remain in attacker-controlled collection or holding addresses, including all Bitcoin stolen during the first three attack waves," Thorn posted on X. He described the sweeps as "deliberate and programmatic" and speculated they were "probably orchestrated with a large language model." Galaxy has flagged approximately 600 suspected attacker addresses to federal investigators and compliance firms, and victim transaction details have aided the on-chain mapping effort.Thorn also warned that every single-signature Coldcard address created after March 2021 remains at risk. He urged holders to move funds immediately to an exchange account or a fresh self-custody address not generated on a Coldcard device. Galaxy later reported that at least 15 different attackers appear to be exploiting the same vulnerability.

Self-Custody Tested at Scale

The Coldcard exploit is the largest hardware wallet exploit on record, according to TRM Labs. Previous hardware wallet incidents, such as the Ledger supply-chain scare in 2023, targeted the software delivery pipeline rather than the cryptographic seed itself.One victim, Jonathan Goodman, told Decrypt he lost 18.25 BTC in seven minutes on the evening of 29 July local time, in the sweep Galaxy dates to 30 July, despite following all recommended security practices. "Perhaps the hardest part about this is that I did everything right," Goodman said.The fact that 87% of the stolen Bitcoin remains unmoved suggests one of two things: the attacker is waiting for enforcement attention to fade before attempting to liquidate, or the compliance pressure from Galaxy's federal referrals is constraining movement. The answer will likely emerge in the coming weeks as investigators and on-chain analysts continue to monitor the flagged addresses.