Galaxy Research: Coldcard Wallet Flaw Linked to Theft of Over 1,778 BTC

ChainThink reported that Galaxy Research said on X on Aug. 14 that it has identified more than 1,778 BTC stolen through a vulnerability affecting Coldcard hardware wallets, worth about $112 million. The firm expects the ultimate loss figure to increase. Galaxy Research said no additional attacks have been confirmed since Aug. 6. According to its findings, attackers methodically reconstructed mnemonic phrases generated by Coldcard and began moving funds at least as early as the pre-dawn hours of July 30. The research team has observed three major waves of activity and more than 30 smaller traces. Combining this with reports from over 190 victims, it also identified at least 33 additional attacker traces, indicating multiple threat actors. Of the stolen assets, 1,531 BTC remains in attacker-controlled addresses. Roughly 246 BTC has been moved, with about 65% routed into CoinJoin transactions and 35% dispersed using techniques including chain stripping. Galaxy Research said it has shared a list of attacker addresses with crypto exchanges, compliance investigators, and law enforcement. It advised users still operating single-signature Coldcard setups to move funds to new addresses as soon as possible.