Coldcard Wallet Attacked: Over $110 Million Worth Of Bitcoin Stolen From Thousands Of Addresses

Hardware wallets are designed to keep cryptocurrency keys secure and away from online threats. However, flaws in the technology used to generate these keys can put funds at risk as seen in a recent attack targeting some Coldcard wallets.

The latest case of Coldcard wallets being exploited came to light on July 30, 2026, when bitcoin was drained from wallets affected by an old firmware vulnerability. The incident has since involved multiple waves of attacks. While the attacks appear to have eased, the amount of bitcoin stolen has continued to rise.

In a post on X on August 14, Galaxy Research titled its update “Coldcard attacks ease, but losses climb” and said, “We have very high confidence that total BTC stolen in the Coldcard exploit has exceeded 1,778 BTC ($112m), though final number will be higher.”

The figure puts the value of stolen bitcoin at more than $112 million, or around Rs 10.7 billion.

It added that the attacks could continue and advised users still storing keys on Coldcard devices to consider moving their funds to safer seeds.

Galaxy Research Finds Multiple Attacker Footprints

Galaxy Research said that, with the help of reports from victims, it had identified at least 33 additional attacker footprints beyond Waves 1, 2 and 3. The firm said it could not confirm whether the different waves or footprints were linked to the same attackers.

However, Galaxy Research said, “We can say with high confidence that multiple attackers were active in the threat environment and exploiting the Coldcard vulnerability.”

The firm said most of the stolen funds had remained largely unmoved. Of the at least 1,778 bitcoin stolen, around 1,531 bitcoin remained in attacker controlled addresses without movement. About 246 bitcoin had been moved after the theft, with 65 per cent flowing into CoinJoin transactions and 35 per cent continuing to move on chain, including through carefully constructed peelchains.

A small amount of the stolen bitcoin could also be traced, at least partly, to deposits into exchanges or bridges.

Coldcard Users Urged To Move Funds

According to TRM Labs, the Coldcard exploit is the third largest crypto attack of 2026 so far. TRM said crypto losses this year have crossed $1.2 billion across 276 incidents. TRM linked the exploit to Coldcard firmware version 4.0.1, released in March 2021, which caused some devices to generate wallet seeds using weaker randomness than intended.

It said updating the firmware would not protect wallets whose seeds were generated under the vulnerable firmware. It advised users who created wallets on affected devices to generate a new seed and transfer their funds to a new wallet.