Losses tied to compromised Coldcard wallets have reached nearly $114 million, according to fresh data. At the same time, the number of small Bitcoin transactions — those under 1 BTC — has jumped to levels not seen since the aftermath of the FTX collapse. Galaxy Research now warns that a fourth wave of thefts may be underway.
The $114 million tally
The cumulative figure comes from tracking funds drained from Coldcard devices over several months. While the exact timeline of the latest losses isn't public, the total has climbed steadily. Galaxy Research's on-chain analysis shows that the attackers have been moving stolen coins in small increments, likely to avoid triggering exchange compliance flags.
Small transfers spike
Bitcoin transactions under 1 BTC have surged to a level comparable to the period right after FTX's implosion in late 2022. That spike was driven by panicked retail users moving funds off exchanges. This time, the pattern looks different: the volume is coming from addresses linked to the Coldcard thefts, not from general market fear. Galaxy's analysts say the small-transfer strategy is a hallmark of the same group behind earlier waves.
Galaxy's warning
Galaxy Research has explicitly flagged a likely fourth wave of thefts. The firm's report notes that the attackers appear to be accelerating their pace. “We're seeing a clear pattern,” the report states, though the firm declined to name specific targets. The warning comes as exchanges and custodians scramble to update their screening tools for the tiny, frequent transfers that have characterized the campaign so far.
The timing isn't great. The crypto market is still digesting regulatory uncertainty from the past quarter, and a fresh wave of thefts could spook institutional investors who were just starting to dip back in. For now, the question is whether the exchanges' detection systems can catch the next batch before the funds get laundered.
