Galaxy Research Flags Possible $88.6M Drain Linked to Coldcard-Generated Bitcoin Addresses

Galaxy Research says attackers may have systematically emptied Bitcoin addresses generated by Coldcard hardware wallets, calling into question long-held assumptions about cold storage safety. Based on on-chain analysis, the firm identified three distinct theft waves that collectively siphoned 1,367.05 BTC—about $88.6 million—across 4,585 addresses. Galaxy described two theft patterns that appear consistent with a single operator, along with a third pattern that could reflect either a refined technique or a separate actor exploiting the same vulnerable key space. Coldcard wallets are widely viewed as a top-tier self-custody option, relying on air-gapped signing and multiple physical security controls. The possibility that funds could be drained without physical access to the device undermines a core expectation of hardware wallets. Galaxy has not confirmed the underlying failure mode. Its report does not determine whether the issue stems from weak entropy during key generation, supply-chain compromise, or a side-channel leak. Still, the scale of the losses has intensified scrutiny. On-chain footprint Galaxy split the activity into two early waves sharing transaction structure and behavioral fingerprints. Those waves affected roughly 3,200 addresses and moved about 1,000 BTC. A third wave arrived later, featuring smaller per-transaction amounts and different timing signatures. Galaxy said the shift could indicate the same attacker adapting to defenses, or a second actor independently identifying and exploiting the same weakness. The firm's findings suggest the attacker did not need to interact with the wallet device or its PIN. Instead, the compromised addresses may have shared a common flaw in how keys were produced. Historically, failures in randomness have repeatedly enabled key recovery—if private keys are generated with predictable entropy, an external observer who recognizes the pattern can reconstruct keys and transfer funds. Entropy risk remains a recurring threat Hardware wallet security depends on isolating the signing key and ensuring the key is truly unpredictable. Many real-world compromises bypass physical isolation by exploiting weak randomness. Galaxy pointed to past incidents, including a 2018 weakness tied to random number generation in certain ECDSA implementations that led to key leakage across multiple blockchains. Coldcard devices use a hardware random number generator and allow users to add extra entropy through dice rolls. Even so, if the vulnerability is rooted in address generation rather than a firmware-specific flaw, the implications could extend beyond a single device model. Galaxy stressed that on-chain forensics cannot definitively pinpoint what happened at the moment keys were created. While the immediate losses—1,367 BTC—are likely unrecoverable, the broader risk is that an entropy failure can retroactively compromise all addresses generated through the same flawed process, turning an isolated incident into a systemic exposure. Market and self-custody implications The disclosure comes as self-custody faces renewed attention amid regulatory friction. Debate over major U.S. crypto legislation could push more users toward non-custodial storage. If a widely trusted hardware wallet shows potential weaknesses, it may complicate arguments encouraging users to hold their own keys. Galaxy noted that the episode does not change Bitcoin's underlying network fundamentals, and the broader ecosystem continues to show strong developer activity. The immediate question is operational: whether Coldcard users can verify if their addresses fall within the drained set, and whether the manufacturer will provide clarity, including any firmware audit findings. Galaxy said publishing without a confirmed root cause is prudent but unsettling, leaving open the possibility that other wallets relying on similar randomness assumptions could face comparable threats—and that the reported $88.6 million may represent only the visible portion of a wider weakness.