Galaxy Research reports 1,596 BTC stolen since July 30 as phishing mimics Coldcard after firmware bug disclosure

Hardware wallet firms Trezor and Foundation warned of rising phishing after a Coldcard firmware vulnerability was disclosed. Proofpoint said emails spoofing Coldcard linked to cloned sites that pushed GitHub hosted batch files installing ScreenConnect, with live chat guiding victims. Galaxy Research confirmed 1,596 BTC stolen since July 30, with potential losses up to $130 million if another round is verified.