Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy

Galaxy Research says the lull likely means vulnerable holders migrated, or were already emptied.

DecryptAug 143 min readVerified

Coldcard Bitcoin Thefts Slow, But Losses Could Top $150 Million: Galaxy — Image · Decrypt

The gist

5-point summary · 1 min

Galaxy Research says the lull likely means vulnerable holders migrated, or were already emptied.

In brief Galaxy Research now puts the Coldcard exploit's confirmed haul above 1,778 BTC (about $112 million), with a suspected fourth wave that would lift it to 2,417 BTC.
The company said Thursday that the Coldcard seed-recreation exploit has now drained more than 1,778 BTC—roughly $112 million—and the final figure will likely be higher.Myriad: Bitcoin's next move?
That was roughly $70.5M worth of Bitcoin stolen at the time.Footprint E, the biggest single owner-confirmed cluster, took 209.94 BTC (roughly $13.3M) across 2,148 addresses; Wave 3 took 208.24 BTC (near $13.0M) from 1,912.
13), 1,499.27 BTC (nearly $93.9M) sat unspent in attackers’ hands.
"The abatement in attack waves is likely because vulnerable users have migrated or most funds have already been drained," it wrote.

$150 Million$112 million$70.5M$13.3M$13.0M$93.9M

Source

In this article

In brief Galaxy Research now puts the Coldcard exploit's confirmed haul above 1,778 BTC (about $112 million), with a suspected fourth wave that would lift it to 2,417 BTC. No confirmed attacker activity has appeared after August 6, across three major waves and more than 30 smaller footprints. Galaxy has spoken to 190-plus victims directly and still tells single-signature Coldcard holders to move funds to fresh addresses. Stolen Bitcoin losses from the massive Coldcard wallet exploit have begun to slow, but the total amount of BTC swiped continues to climb—and the worst may not be over just yet.That’s the latest from Galaxy Research, the crypto research firm that’s been tracking the exploit from the start. The company said Thursday that the Coldcard seed-recreation exploit has now drained more than 1,778 BTC—roughly $112 million—and the final figure will likely be higher.Myriad: Bitcoin's next move? Click to make your prediction.Galaxy said it has "very high confidence" in the tally, which counts confirmed, owner-attributed thefts since the attack opened on July 30, per its running thread on X."Attackers have been executing this attack since at least early morning July 30, 2026, systematically recreating Coldcard-generated seeds and sweeping the funds onchain," Galaxy Research wrote.Among Galaxy's confirmed waves and footprints, none shows activity after August 6. That doesn't mean the method stopped working. It means the easy targets are gone. The bulk of funds have remained largely unmoved since stolen from victims. Of the at least 1,778 BTC that has been stolen, 1,531 BTC remains in attacker-controlled addresses unmoved. ~246 BTC has been moved by attackers after the theft, with 65% flowing into Coinjoin transactions… pic.twitter.com/OHjJkr1x6D — Galaxy Research (@glxyresearch) August 14, 2026What the chains showA 2021 firmware update quietly rerouted Coldcard's seed generation off its hardware random-number chip and onto a software stand-in, collapsing key strength from 128 bits to as low as 40. Attackers could rebuild seeds from a device's serial number and clock state, then sweep the coins without resorting to phishing or malware techniques and even without physical access to the actual devices.Galaxy's breakdown puts the largest proven wave—Wave 1—at 1,082.65 BTC pulled from 1,195 addresses in the opening minutes. That was roughly $70.5M worth of Bitcoin stolen at the time.Footprint E, the biggest single owner-confirmed cluster, took 209.94 BTC (roughly $13.3M) across 2,148 addresses; Wave 3 took 208.24 BTC (near $13.0M) from 1,912. Across three proven waves and 41 smaller footprints, the firm charts more than 5,200 drained addresses. As of block 962,304 (data Aug. 13), 1,499.27 BTC (nearly $93.9M) sat unspent in attackers’ hands. Among the confirmed, high-confidence waves and footprints of attacker activity, none occurred after August 6. Additional victims continue to report to Galaxy Research (we've spoken to 190+ directly), helping us directly attribute losses and confirm additional footprints, but none… pic.twitter.com/8jEdFdJEog — Galaxy Research (@glxyresearch) August 14, 2026Of the thin slice Galaxy can trace to a final endpoint—174.97 BTC—most went into coinjoin privacy rounds, with small amounts reaching KuCoin and Jump Crypto.Galaxy has spoken to more than 190 victims directly to attribute losses. "The abatement in attack waves is likely because vulnerable users have migrated or most funds have already been drained," it wrote. The company repeats its advice: "If you still hold funds on a single-signature Coldcard wallet, you are advised to move your funds to new addresses."The episode has already pushed roughly $15 billion in Bitcoin to safer custody and drawn a warning from Ledger that wallet security has to adapt to AI-assisted discovery. Hardware-firm peers have also flagged a phishing surge riding the panic.Galaxy still carries a candidate fourth wave—638.5 BTC it hasn't confirmed—that would lift the toll to 2,417 BTC, above $151.3 million by today’s prices.Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.

Integrity note · Xela does not rewrite or paraphrase article content. The excerpt above is the source publication's own words, sanitized for display. For the full piece — including any quotes, charts, or images — read it at Decrypt. Xela's rewritten version is off for this story, so there's no editorial angle attached — you're getting the source's reporting unfiltered. When the rewrite is on, we add a What this means block underneath with the operator/trader takeaway.

What people are saying

Discussion

Hot takes

0/280

Loading takes…

Comments

Discussion · 0

Loading comments…

Keep readingCrypto & Web3 desk

See all in Crypto →

·Aug 16

The SEC meeting that wasn't: State of Crypto

There were hopes that regulators could move if the Clarity Act didn't advance, but those, too, may be paused.

CoinDeskVerified

·Aug 16

Gemini 3.7 Flash Review: Google's Cheap Model Isn’t Dumb Anymore

Three weeks after a Flash release that couldn't produce a working file, Google's budget tier zero-shots a playable game. It still can't reason, and a free 27B model still writes better.

DecryptVerified

·Aug 16

Crypto investors are looking past market-cap rankings and back to fundamentals

Investors are starting to judge crypto tokens on usage, economics and value capture rather than market-cap rank, industry executives said.

CoinDeskVerified

·Aug 16

Bitcoin analysis shows what bulls need to do next to end this bearish 2026

Bitcoin stabilizes near $63,000, but reclaiming $64,000 is the real test Bitcoin is stabilizing near $63,100 after buyers defended the lower part of its recent range. That is constructive, but it is not yet a confirmed recovery. BTC must first overcome resistance near $63,175-$63,270, while reclaiming and holding $64,000-$64,095 remains the more important test. Key takeaways for Bitcoin traders and investors Current position: BTC is holding above the previous month’s lower value boundary near $62,380. Immediate resistance: Buyers need to clear $63,130-$63,175, followed by $63,247-$63,270. Main recovery test: A sustained reclaim of $64,000-$64,095 would carry much more weight than a temporary bounce near $63,000. Major support: The broader $62,380-$62,535 region remains the most important defended zone. Bullish confirmation: Repeated closes, consolidation or a successful retest above $64,095 would show that Bitcoin is beginning to establish higher accepted value. Data note: The latest daily, four-hour and one-hour candles were incomplete when this analysis was prepared. Exchange-specific Bitcoin prices may also differ slightly. I'm also closely monitoring the digital asset space after , putting immediate pressure on lower order-flow shelves as bulls fight to defend structural trendlines. Regulatory headwinds also resurfaced as the , injecting fresh institutional hesitation into active trading books. Meanwhile, broader risk sentiment showed divergence across asset classes as , underscoring rotational breadth away from mega-cap tech into small-cap momentum. Macro headwinds and geopolitical posturing remain front and center following headline chatter that , all while monetary policy uncertainty lingers after amidst baseline model variances. Why Bitcoin’s stabilization is constructive but incomplete Bitcoin recently fell to approximately $62,535, where the decline attracted meaningful buying. Price subsequently recovered toward $63,100, strengthening the case that buyers are willing to defend the lower part of the previous month’s trading range. What stands out to me, however, is how little upward progress followed that buying. Several periods showed positive buying pressure, but BTC remained concentrated around $63,050 and repeatedly struggled to extend beyond $63,150-$63,175. In simple terms, buyers have shown that they can slow the decline, but they have not yet shown that they can move Bitcoin into a clearly higher trading range. This is the difference between stabilization and recovery: Stabilization means sellers are no longer pushing price lower with the same ease. Recovery means buyers are lifting price, holding above resistance and shifting the market’s most active trading area higher. Bitcoin has shown the first condition. The second still needs confirmation. Why $62,380 and $64,095 matter The previous month’s value area provides a useful map of where most Bitcoin trading took place: Value Area Low near $62,380: The lower boundary of the previous month’s heavily traded range. Point of Control near $64,095: The price that attracted the most trading activity during the month. Value Area High near $65,050: The upper boundary of the previous month’s accepted range. BTC is currently about $720 above the monthly Value Area Low, but almost $1,000 below the monthly Point of Control. Holding above $62,380 tells us that demand inside the previous month’s range has not completely failed. Remaining below $64,095 tells us that buyers have not regained control of the broader value structure. This is also why $64,095 may be more important than $64,000 itself. The round number attracts attention, but $64,095 represents the previous month’s busiest price area. A brief move above $64,000 could still become another failed breakout. Holding above $64,095 would provide stronger evidence that the market is accepting higher prices again. As discussed in our previous analysis, Bitcoin’s created technical repair work for buyers. That repair is not complete simply because BTC has bounced from $62,535. Bitcoin support and resistance levels to watch What would strengthen the bullish Bitcoin scenario? Swing traders should have 3 key price levels: The Value Area Low (VAL), Point of Control (POC) and Value Area High (VAH) of the previous month. Together, these levels map the previous month’s main area of accepted trading: the VAL marks its lower boundary, the VAH its upper boundary, and the POC the price where the most volume traded. Traders watch them because holding inside the area suggests continued acceptance, while a sustained break outside it may signal that the market is searching for a new value zone. The first constructive step would be sustained trade above $63,175. Buyers would then need to clear and hold above $63,247-$63,270. That would improve the probability of a move toward $63,350 and, eventually, the much larger $64,000-$64,095 test. A more convincing recovery would include: Bitcoin reclaiming $64,000. Price moving above the monthly point of control near $64,095. A pullback successfully defending the reclaimed area. Trading activity beginning to concentrate above $64,095 rather than immediately slipping back below it. If that sequence develops, approximately $65,050 becomes the next major value-area objective. What this means: Acceptance is more than touching a level. It means price spends time above it, survives pullbacks and begins treating the higher area as support. What would weaken the stabilization attempt? Failure to hold $62,920-$62,800 would weaken the current short-term base and increase the probability of another test of $62,535. The more serious bearish development would be sustained trade below $62,380. That would place BTC outside the previous month’s accepted value area and suggest that the market may need to search for demand at lower prices. Traders should still distinguish between a brief move below $62,380 and genuine acceptance beneath it. Crypto markets can produce fast stop-runs through visible support before reversing. Repeated closes or continued trading below the level would carry more bearish significance than a momentary sweep. What Bitcoin traders may consider watching Different traders may use these levels in different ways, at their own discretion: Short-term breakout confirmation: Watch whether BTC can break above $63,175 and successfully retest it, with $63,247-$63,270 providing the next validation area. Support-zone reaction: If BTC returns to $62,380-$62,535, watch whether buyers defend it again or whether selling begins to hold below the zone. Broader recovery confirmation: Treat $64,000-$64,095 as the decisive recovery test instead of assuming that every bounce from $63,000 marks a durable bottom. Because Bitcoin trades continuously, weekend conditions can sometimes involve thinner liquidity and less reliable breakouts. Confirmation through time, repeated closes or a successful retest may therefore be more useful than reacting to the first price spike. What should Bitcoin traders watch next? Bitcoin has defended the lower part of the previous month’s value area, but the rebound still needs to prove itself. The immediate challenge is to move beyond $63,175 and $63,270. The much larger test remains $64,000-$64,095. A successful reclaim would indicate that Bitcoin is returning toward the center of the previous month’s accepted value rather than merely bouncing from support. Until that happens, Bitcoin may be stabilizing, but it is not yet showing a fully confirmed bullish recovery. This analysis presents conditional market scenarios and opinions (not promises) at investingLive.com, not a guarantee of future performance. Traders should consider volatility, position size and their own risk limits before acting. This article was written by Itai Levitan at investinglive.com.

ForexliveSingle source

Newsletter

Track crypto & web3 every morning.

Daily digest tuned to this beat. The 5 stories most worth your time. Unsubscribe anytime.