Coldcard Hack Stole Over $112 Million in Bitcoin, Galaxy Research Says

Highlights:

• Galaxy Research says the Coldcard wallet hack has stolen over $112 million in Bitcoin, with losses still rising.
• No confirmed Coldcard attacks have appeared since August 6, but Galaxy says the risk has not ended.
• Hackers still hold 1,531 stolen BTC without moving it, while smaller amounts have gone through mixers.

Galaxy Research says the Coldcard exploit has caused losses of more than 1,778 Bitcoin (BTC), worth about $112 million. However, confirmed attack activity now appears to have slowed. Galaxy said it has high confidence in its current estimate. The firm also expects total losses to rise as more victims report stolen funds.

Galaxy Research shared its latest findings on August 14, in a series of posts on X. The firm said attackers have exploited the Coldcard vulnerability since at least the early morning of July 30. According to Galaxy, the attackers recreated wallet seeds generated by Coldcard devices. They then used those seeds to access victims’ wallets and move Bitcoin to addresses they controlled.

Galaxy has tracked three major attack waves and more than 30 smaller patterns of suspicious activity. One cluster, identified by the firm as “Footprint E,” has been the largest and appears to involve a more sophisticated attacker. 

COLDCARD ATTACKS EASE, BUT LOSSES CLIMB

We have very high confidence that total BTC stolen in the Coldcard exploit has exceeded 1,778 BTC ($112m), though final number will be higher.

That doesn't mean attacks cannot continue — if you are still storing keys on Coldcard device,… pic.twitter.com/LURQuv0v3K

— Galaxy Research (@glxyresearch) August 14, 2026

Galaxy Finds No Confirmed Bitcoin Attacks Linked to Coldcard After August 6

Although the total amount stolen has increased, Galaxy said it has not identified any confirmed attacker activity after August 6. The research team has spoken directly with more than 190 victims, helping investigators connect additional losses to the exploit. However, none of those reports have provided evidence of a confirmed attack occurring after August 6.

Galaxy warned that the slowdown does not prove the threat has ended. The firm believes attack activity may have eased because vulnerable users moved their funds or because many exposed wallets had already been emptied. As a result, Galaxy advised anyone still holding BTC in a single-signature Coldcard wallet to move the funds to new addresses generated from safer wallet seeds.

Further investigation has also expanded the known scale of the incident. In addition to the three major waves, Galaxy has identified at least 33 separate attacker footprints with help from victim reports. The firm cannot yet determine whether all those footprints belong to different attackers. However, Galaxy said it has high confidence that multiple attackers were actively exploiting the Coldcard vulnerability.

Most Stolen Bitcoin Remains in Attacker Wallets

Onchain tracking shows that most of the stolen Bitcoin has not moved since the thefts occurred. Of the more than 1,778 BTC identified so far, around 1,531 BTC remains unmoved in attacker-controlled addresses. Roughly 246 BTC has been transferred after the theft.

The bulk of funds have remained largely unmoved since stolen from victims. Of the at least 1,778 BTC that has been stolen, 1,531 BTC remains in attacker-controlled addresses unmoved. ~246 BTC has been moved by attackers after the theft, with 65% flowing into Coinjoin transactions… pic.twitter.com/OHjJkr1x6D

— Galaxy Research (@glxyresearch) August 14, 2026

Galaxy said about 65% of the moved Bitcoin entered CoinJoin transactions, which combine transactions in ways that can make fund tracing more difficult. The remaining 35% continued moving through the blockchain, sometimes through carefully structured chains of smaller transactions. Only a small portion of the stolen funds has so far been traced, at least partly, to cryptocurrency exchanges or bridges.

Galaxy Research has shared lists of suspected attacker addresses with crypto exchanges, compliance firms, blockchain investigators and law enforcement agencies. The aim is to help centralized platforms identify and potentially freeze stolen funds if attackers attempt to deposit them. The firm is also continuing to collect victim reports and provide tracing information as investigators work to determine the full scale of the Coldcard exploit.