Coldcard users have lost more than $115 million in Bitcoin to a string of thefts that Galaxy Research ties to a flawed firmware release from March 2021. The losses total 1,778.58 BTC swept from 8,680 addresses since July 30, according to data through August 13.
The scale of the losses
Galaxy Research counted 1,778.58 BTC gone. Only 192 people have reported losses, totaling 714.81 BTC — about 40% of the haul. Individual reports range up to 58.97 BTC, with a median near 1.03. The rest, 1,063.76 BTC across 6,890 addresses, has no owner attached.
A vulnerability that sat for five years
Every stolen coin postdates the flawed firmware release on March 17, 2021 (block 674,951). Not one of the 6,303 coins taken predates that. The earliest dated address reported by victims is from March 22, 2021. Drained addresses had sat untouched for a median of 1,292 days — about 3.5 years. So attackers went after old, dormant wallets.
How the attackers operated
Wave 1 took 61% of the total loss, $70.2 million, in under an hour — nine blocks in 41 minutes. The operator paid a fixed fee of around 30 sat/vByte, drained one address per transaction, hit 1,195 addresses, and sent proceeds to four collector wallets. Another footprint, dubbed E, touched 2,147 addresses, batching up to 795 into a single transaction. Most of Wave 1's haul hasn't moved: 1,082.57 of 1,082.65 BTC still in place. Footprint E moved nearly all of its 209.94 BTC, leaving 4.38. Wave 3's take — 207.73 BTC — now sits in script-hash vaults.
What Galaxy Research is doing
The firm says it has spoken with more than 200 victims, both to support them and to gather intelligence on the attackers. It warned of fresh attacks on August 3. The attackers are still active, apparently.
The unresolved question is who owns the 1,063.76 BTC across 6,890 addresses. Until those owners step forward, the full picture of the theft remains incomplete.
