The Coldcard Bitcoin theft has now passed $100 million in losses across three confirmed attack waves, with a suspected fourth wave that could push the total to $130 million. Galaxy Research reports that 90% of the stolen Bitcoin remains unmoved, suggesting the attackers are holding rather than cashing out. Investigators are still trying to determine how the fourth wave works and whether it's connected to the earlier breaches.
Three waves, then a possible fourth
The first three attack waves hit Coldcard users over the past several weeks. Each wave exploited different weaknesses, though the exact methods haven't been fully disclosed. The cumulative losses crossed the nine-figure mark this week, making it one of the larger hardware-wallet thefts on record. Now a suspected fourth wave is under scrutiny. If confirmed, it would add roughly $30 million to the total.
Why the stolen Bitcoin isn't moving
Galaxy Research's finding that 90% of the stolen Bitcoin hasn't been moved is unusual. In most large-scale crypto thefts, the funds get shuffled through mixers or exchanges quickly. Here, the bulk of the haul is sitting still. That could mean the attackers are waiting for the heat to die down, or they're planning a coordinated liquidation. Either way, it gives investigators a longer window to trace the coins.
What Coldcard users should know
Coldcard has issued security advisories and pushed firmware updates. The company hasn't said whether it will reimburse affected users. For now, anyone using a Coldcard device should update to the latest firmware and consider moving funds to a new seed phrase generated offline. The exchange that processed some of the stolen funds paused withdrawals for about six hours last week, but it's back to normal operations.
Investigators are expected to release a technical report on the fourth wave within the next two weeks. That report could clarify whether the attack is a variant of the earlier ones or something entirely new. Until then, the stolen Bitcoin sits in wallets that haven't budged — and the clock is ticking on a potential $130 million total.
