Galaxy Research: Coldcard wallet flaw may have enabled thefts topping 2,000 BTC

Security concerns are mounting around a vulnerability affecting Coldcard hardware wallets. Galaxy Research, the research arm of Galaxy Digital, said losses tied to the flaw could surpass 2,000 Bitcoin, estimating a potential total of about 2,055 BTC—worth more than $130 million at current prices. In a report released by the firm, Galaxy Research said 1,596 BTC has been confirmed stolen so far across three major attacks and 14 smaller incidents. The activity is believed to have impacted roughly 7,300 unique Bitcoin addresses. Researchers attributed the issue to a weakness in the random number generation process used by certain Coldcard devices. The affected versions reportedly include specific firmware builds for Coldcard Mk3, Mk4, Mk5, and the Coldcard Q. Coinkite, which makes Coldcard, issued an urgent software update after the flaw was identified and urged users to upgrade immediately. Galaxy Research added that evidence points to a possible fourth attack that has not yet been fully confirmed. If included, total stolen funds could rise to 2,055 BTC. The team said it has been coordinating with U.S. federal investigative agencies and multiple cryptocurrency exchanges to help identify the perpetrators and track movements of the stolen assets. The report also noted that most of the funds appear untouched: Galaxy Research estimates about 90% of the stolen Bitcoin remains at the original addresses, suggesting the attackers may not yet have begun laundering or selling. This is not investment advice.