A wave of Bitcoin thefts targeting Coldcard hardware wallet users has slowed in recent weeks, but Galaxy Research warns that total losses from the campaign could ultimately exceed $150 million.
What Happened
According to analysis from Galaxy Research, attackers exploited weaknesses tied to certain Coldcard setups to drain funds from unsuspecting Bitcoin holders. The scale of the operation has raised alarm across the hardware wallet community, which typically markets these devices as among the most secure ways to store cryptocurrency offline.
Galaxy's researchers estimate that the cumulative damage from the thefts may climb past the $150 million mark once all affected wallets are accounted for. The figure underscores how a single vulnerability, when exploited at scale, can inflict outsized damage on self-custody users who believed their holdings were beyond reach.
A slowdown in thefts may signal not safety, but that the vulnerable wallets have already been emptied.
Why The Slowdown Matters
The recent decline in reported thefts might sound like reassuring news, but Galaxy cautions against reading it that way. The lull, analysts suggest, likely reflects one of two outcomes: either at-risk holders recognized the danger and migrated their funds to secure setups, or the vulnerable wallets have already been drained by attackers.
In other words, the drop in activity could indicate that the pool of exploitable targets is shrinking simply because there are fewer victims left to hit. That interpretation offers little comfort to those who may have already lost their coins without realizing it.
The episode serves as a stark reminder that hardware wallets, while generally robust, are not immune to compromise—particularly when users fall prey to social engineering, tampered devices, or flawed configurations.
- Losses could top $150 million across affected users
- The recent slowdown may reflect drained or migrated wallets
- Self-custody users are urged to verify device integrity and setup
The Takeaway
For Bitcoin holders relying on cold storage, the incident reinforces the importance of vigilance. Verifying the authenticity of hardware, keeping firmware current, and being wary of unsolicited instructions remain essential defenses against these kinds of campaigns. As Galaxy's findings show, even the most trusted self-custody tools require careful handling to keep funds safe.