A sophisticated theft campaign targeting users of Coldcard hardware wallets has drained more than $100 million in Bitcoin across three confirmed waves of attacks, according to new findings from Galaxy Research, with investigators now examining evidence of a possible fourth wave that could push total losses even higher.
Inside the Attack Campaign
Galaxy Research documented three distinct waves of coordinated theft aimed at holders of Coldcard devices, a popular self-custody hardware wallet used to store Bitcoin offline. The confirmed losses have surpassed the $100 million mark, marking one of the more significant thefts to strike the hardware wallet ecosystem.
Despite the scale of the operation, investigators noted that the vast majority of the stolen funds have not been touched. Roughly 90% of the pilfered Bitcoin remains sitting in wallets controlled by the attackers, unmoved since the thefts occurred.
Nearly all of the stolen Bitcoin remains frozen in place, offering a rare window for tracing and potential recovery.
The fact that such a large portion of the coins has stayed dormant gives blockchain analysts and law enforcement a valuable opportunity to track the funds and potentially coordinate with exchanges to freeze assets should the thieves attempt to launder or cash out.
A Suspected Fourth Wave
Beyond the three confirmed attack waves, Galaxy Research said it is investigating evidence pointing to a potential fourth wave. If verified, the additional theft would raise the cumulative total to approximately $130 million.
The investigation underscores ongoing concerns about the security of self-custody solutions, even those designed with offline storage in mind. Hardware wallets are generally regarded as among the safest ways to store cryptocurrency, making the breadth of this campaign particularly alarming for the community.
Key takeaways from the Galaxy findings include:
- Confirmed losses exceed $100 million across three attack waves
- Around 90% of the stolen Bitcoin has yet to be moved
- A suspected fourth wave could raise totals to roughly $130 million
As the probe continues, Coldcard users are being urged to remain vigilant and review their security practices while researchers work to determine the full scope of the campaign and identify how the attackers gained access to victims' funds.