Coldcard Bitcoin Theft Exceeds $100 Million Across Multiple Attack Waves, Galaxy Research Reports

Confirmed losses from a Coldcard wallet attack campaign have now exceeded $100 million, according to research published by Galaxy Digital’s research arm on August 4, 2026. The breach has affected approximately 7,300 Bitcoin addresses, with 1,596 BTC stolen across three major attack waves complemented by 14 additional smaller incidents.

Galaxy Research said the updated figure represents a significant increase from its earlier assessment published on Saturday, which tracked 1,367 BTC stolen across 4,585 addresses. The research team gathered information from 73 victim reports that helped confirm the scope of the first three major attacks and identify the smaller attack footprints.

Scale of the Ongoing Threat

The security incident continues to evolve, with Galaxy Research identifying a suspected fourth attack wave that could push total losses to approximately 2,055 BTC—roughly $130 million at current valuations. However, the research team excluded this wave from its confirmed estimate pending victim verification, though it assessed the activity with “medium-high” confidence as originating from attackers.

A striking detail emerged from the analysis: approximately 90% of the stolen Bitcoin has remained unmoved across addresses linked to all three confirmed attack waves. This immobility could indicate attackers are consolidating their position or awaiting opportunities to cash out through less transparent channels.

Response and Ongoing Investigation

Galaxy Research has actively shared information about both attacker and victim addresses with United States federal law enforcement agencies, major cryptocurrency exchanges, and cyber-investigation companies to track the stolen funds and prevent further movement.

The research organization warned that attacks were ongoing and issued an urgent recommendation for Coldcard users to immediately transfer their holdings to secure addresses. Galaxy emphasized the fluid nature of the situation, noting that the confirmed victim count could still increase as affected individuals became aware of the breach.

The incident highlights vulnerabilities in hardware wallet security and the coordinated nature of modern cryptocurrency theft operations. Galaxy Research’s approach of cross-referencing victim reports with blockchain analysis demonstrates how community transparency—when victims come forward to researchers—can help map the full scope of security breaches that might otherwise remain obscured. Large-scale thefts across Bitcoin wallets underscore critical security lessons applicable to all crypto assets and blockchain ecosystems worldwide.

Source: Galaxy Research, via Cointelegraph. Not financial advice.