Galaxy Research warns that total losses from the ongoing Coldcard hardware wallet exploit could ultimately reach $130 million as security investigators monitor for additional theft waves. The cryptocurrency research firm currently confirms more than $100 million in Bitcoin losses across three documented attack waves, with analysis of a potential fourth wave still pending The Block.
According to Galaxy Research, approximately 90 percent of the stolen cryptocurrency remains unmoved in attacker-controlled wallets, suggesting the perpetrators have not yet liquidated the majority of their haul Cointelegraph. The firm disclosed via social media that loss calculations could increase significantly once investigators confirm whether a suspected fourth wave of attacks occurred, potentially pushing the aggregate damage to the estimated $130 million ceiling.
The security incident has targeted users of Coldcard hardware wallets, specialized devices designed to store Bitcoin private keys in offline environments typically regarded as highly secure against remote intrusion. The exploit has unfolded across multiple distinct phases, with researchers documenting three confirmed waves of theft while examining blockchain data to verify the scope of a potential fourth wave. This wave-based progression indicates a systematic campaign rather than isolated incidents, with each phase potentially targeting different user cohorts or vulnerability windows. The identification of distinct attack waves suggests the perpetrators may have accessed user funds through a persistent vulnerability or supply chain compromise affecting multiple devices over an extended period The Block.
Investigators continue tracking the movement of funds across the Bitcoin blockchain to assess whether additional wallets fell victim to the attack methodology. The static nature of most stolen funds—remaining unmoved since the thefts occurred—provides law enforcement and blockchain analysts with continued opportunities to trace the assets, though recovery remains challenging without private key access. The fact that nine-tenths of the looted Bitcoin has not moved through exchanges or mixing services suggests the attackers may be strategizing liquidation methods or awaiting favorable market conditions before attempting to convert the assets to fiat currency or other cryptocurrencies. This delay in fund movement offers a narrow window for potential intervention if authorities can identify the parties responsible Cointelegraph.
The Coldcard exploit represents a significant security event within the hardware wallet sector, devices typically marketed as providing maximum protection against online threats. Galaxy Research's estimates position this incident among the larger hardware wallet-specific losses recorded in recent years, particularly if the upper bound of $130 million materializes upon confirmation of the fourth suspected attack wave. The research firm's monitoring of both confirmed and potential additional waves underscores the ongoing nature of the investigation and the possibility that victim counts and loss figures may continue evolving as forensic analysis proceeds. Security researchers emphasize that the confirmation of a fourth wave would substantially expand the scope of one of the most significant hardware wallet compromises documented in the cryptocurrency space, potentially prompting renewed scrutiny of hardware wallet manufacturing and distribution security protocols The Block.