Bitcoin losses tied to the Coldcard seed-recreation exploit have continued to rise even as the pace of thefts appears to have slowed, according to a new update from Galaxy Research. The firm said confirmed, owner-attributed thefts since July 30 now total more than 1,778 BTC, worth about $112 million at the time of its assessment, and warned that the eventual total is likely to be higher.
Galaxy said it has very high confidence in that figure, which is based on cases it could confirm directly with wallet owners. While the firm found no confirmed attack activity after Aug. 6 across the waves and footprints it tracked, it said that does not mean the exploit stopped working, but rather that the easiest targets may already have been drained or moved.
Attack pattern and current balances
Galaxy said attackers have been exploiting the flaw since at least the early morning of July 30, 2026, systematically recreating Coldcard-generated seeds and sweeping funds on-chain. Across three proven waves and 41 smaller footprints, the firm said it has mapped more than 5,200 drained addresses.
Most of the stolen bitcoin has not yet been moved far. Of the at least 1,778 BTC confirmed stolen, 1,531 BTC remains parked in attacker-controlled addresses, according to Galaxy. The report said about 246 BTC was moved after the thefts, with 65% of that flow entering Coinjoin transactions.
How the exploit worked
Galaxy traced the issue to a 2021 firmware update that shifted seed generation away from Coldcard's hardware random-number chip to a software substitute. According to the firm, that change reduced key strength from 128 bits to as low as 40 bits.
That weakness allowed attackers to reconstruct wallet seeds from a device's serial number and clock state, Galaxy said. The method did not require phishing, malware, or physical access to the device itself.
Largest confirmed theft waves
The biggest proven wave identified by Galaxy, labeled Wave 1, accounted for 1,082.65 BTC taken from 1,195 addresses in the opening minutes of the attack. At the time, that haul was worth roughly $70.5 million.
The largest single owner-confirmed cluster, called Footprint E, involved 209.94 BTC across 2,148 addresses. Another major wave, Wave 3, drained 208.24 BTC from 1,912 addresses. Galaxy said it has spoken directly with more than 190 victims in order to attribute losses.
Where funds have gone and what could come next
Galaxy said it can trace only a relatively small share of the stolen bitcoin to a final endpoint. Of 174.97 BTC it could follow that far, most entered Coinjoin privacy rounds, while smaller amounts reached KuCoin and Jump Crypto.
The firm said the drop-off in new waves likely reflects holders moving vulnerable funds or attackers having already emptied most exposed wallets. Even so, Galaxy still includes a candidate fourth wave of 638.5 BTC that it has not yet confirmed. If that cluster is verified, total losses would rise to 2,417 BTC, or more than $151.3 million at current prices.
The incident has already prompted roughly $15 billion in Bitcoin to shift to what Galaxy described as safer custody. The firm reiterated its guidance that anyone still holding funds on a single-signature Coldcard wallet should move those funds to new addresses, while other hardware wallet firms have also warned of a phishing surge linked to the fallout.
Source: decrypt.co