Coldcard compromise expands; users told to move funds from impacted addresses immediately

Coldcard has been compromised, with total stolen funds climbing to 1,367.05 BTC—about $88.6 million—spanning 4,585 addresses, Huoxing Finance reported on Aug. 2. Galaxy Research Director Alex Thorn said the intrusion remains active and urged anyone who has not yet migrated to immediately move assets out of addresses generated by Coldcard. He also called on affected users to proactively share information to help trace the stolen coins and support reporting to law enforcement. Thorn said three previously confirmed large-scale incidents showed clear programmatic hallmarks, with similar transaction patterns that appear to have been executed via automation. The BTC taken in those events is still sitting in attacker-controlled addresses and has not been moved. More recently, Thorn noted an uptick in smaller, opportunistic thefts in which funds are transferred and laundered within hours. Some of those flows have been routed through cross-chain services such as ThorChain and onward to offshore gambling platforms. Thorn warned that all single-signature Coldcard addresses generated after the March 2021 firmware update could ultimately be compromised, and said users should migrate assets as soon as possible. Historically, stolen funds in similar cases remained dormant for an average of 3.18 years, with a median of 3.55 years, suggesting long-term holders are often the most affected. Thorn said most identified stolen assets in the current incident have not yet moved, and related addresses have been shared with U.S. law enforcement and industry contacts. Calling the event a major setback for Bitcoin self-custody, Thorn urged the industry to strengthen security practices, improve user education, and raise risk awareness around the operational complexity of self-custody.