Galaxy disclosed this week that attackers drained roughly $70 million in Bitcoin from 1,196 wallets. The theft happened before the company publicly revealed a vulnerability in Coldcard hardware wallets. The timing raises questions about how long the flaw went unpatched and what users could have done to protect themselves.
The scale of the drain
The breach hit 1,196 wallets, each losing a portion of the total $70 million. Galaxy hasn't said how the attackers gained access or whether the wallets were all linked to a single service. What's clear is that the sum is large enough to rank among the bigger single-entity thefts this year.
The Coldcard connection
Coldcard, a popular hardware wallet known for its security focus, had a vulnerability that wasn't disclosed until after the drain. Galaxy's report highlights that the exploit was possible because users hadn't applied the latest firmware. The company didn't name the specific vulnerability or say when Coldcard first learned of it.
What users should do now
The incident is a blunt reminder that even hardware wallets aren't immune if firmware lags. Galaxy urged anyone using Coldcard devices to update to the newest version immediately. For those who can't verify their firmware status, moving funds to a freshly initialized wallet is the safer bet. The timing isn't great — the crypto market is already jittery — but the fix is straightforward.
No word yet on whether law enforcement is involved or if Galaxy plans to reimburse affected users. The next concrete step is likely a detailed post-mortem from Coldcard, which hasn't been published as of this writing.
