Coldcard Exploit: 1,719 BTC Confirmed Stolen; Total Losses Could Top $130M

The Coldcard hardware wallet breach is coming into focus. Galaxy Research says it has high confidence that at least 1,719 BTC have been stolen from multiple user accounts, worth about $111 million at recent prices. The tally may still rise: the team's latest estimate, cited in the original report, suggests total losses are likely to exceed $130 million once all unresolved cases are validated. Investigators have identified more than 25 distinct attack patterns and now believe multiple threat actors are exploiting the weakness. Galaxy reports it has heard from more than 250 victims. If all cases are ultimately confirmed, total stolen funds could surpass 2,300 BTC. At this stage, the only affected devices are said to be Coldcard Mk3, Mk4, Mk5, and the Q model. Galaxy has not pointed to compromise outside the Coldcard ecosystem and says there is no evidence the issue has spread to other signing devices or wallet platforms. A blow to the self-custody narrative The incident strikes at the heart of Bitcoin self-custody. Coldcard has long been marketed as a top-tier option for air-gapped, high-security storage. A breach at this scale—and one that appears to have been exploitable for an extended period—is likely to undermine confidence among users who rely on the device to protect significant holdings. The timing also lands amid a sensitive policy debate in Washington. Just days ahead of a key Senate vote on major crypto legislation, an exploit of this magnitude gives critics of more permissive self-custody rules fresh ammunition. Hardware wallets are often positioned as the strongest safeguard against hacking, yet they remain exposed to supply-chain risk, firmware tampering, and physical side-channel techniques. Neither Coinkite nor Galaxy has publicly detailed the entry point. The breadth of observed attack patterns suggests this was not a single, isolated flaw. Possible causes range from random number generator misconfiguration to compromised components in the supply chain or weaknesses in device communications. For victims, Bitcoin's irreversibility compounds the damage: once coins move, recovery is effectively off the table. What comes next With more than 250 potential victims identified, pressure is building on Coinkite, Coldcard's manufacturer. The company has not released a full technical postmortem, and the market is watching to see whether existing devices can be patched or whether replacements will be required. The appearance of multiple independent attackers also raises the possibility the vulnerability circulated privately before becoming public—discovered, shared, and exploited in closed channels until losses became too large to ignore. Institutional holders are likely to respond by tightening device-review processes. Interest could increase in multisig configurations and custodian-based cold storage, where operational controls and insurance coverage are more common. The insurance gap is especially stark: most self-custody users carry no coverage, while regulated custodians often include policies as part of the service. Even if $130 million is small relative to Bitcoin's total market value, it is large enough to draw regulatory scrutiny, particularly as lawmakers consider how wallet providers should be classified and supervised. Key questions remain Galaxy's report does not explain how attackers exfiltrated private keys or initiated transactions without physical access to devices. One scenario is temporary access—during shipping, through a compromised reseller, or another brief window—followed by later draining of funds. With more than 25 patterns observed, investigators believe multiple techniques were used. It also remains possible some victims installed malicious firmware obtained from unofficial sources. The broader industry impact may be lasting. Hardware wallet security depends as much on trust and process as on cryptography. When that trust breaks at a scale measured in thousands of BTC, rebuilding it is difficult. Competitors are likely to use the episode to promote their own devices, while the central lesson for users remains unchanged: self-custody requires ongoing vigilance, and no single device should be treated as an impenetrable shield.