Coldcard Hardware Wallet Exploit Blamed for Over $100M in Bitcoin Theft

Galaxy Research has identified 1,596 BTC—worth more than $100 million—stolen from around 7,300 addresses across three confirmed attack waves tied to a vulnerability in the Coldcard hardware wallet. An unconfirmed fourth wave could push total losses to 2,055 BTC, roughly $130 million.

According to Galaxy, about 90% of the stolen funds have not yet moved, suggesting the attackers may be holding the assets rather than immediately cashing out. This could give investigators and law enforcement a window to trace and potentially recover some of the funds before they are laundered. Galaxy Research is working with U.S. authorities as part of the ongoing investigation.

Hardware wallets are widely marketed as one of the safest ways to store cryptocurrency, since they keep private keys offline. This incident is a reminder that even dedicated security hardware can contain flaws that attackers will exploit at scale, and that no single storage method is completely risk-free.