Galaxy identified a second attack, lifting total losses above $75 million. Researchers tracked 1,158.81 BTC stolen from 2,673 Coldcard-linked addresses. Security experts urged affected users
Galaxy Research said it identified a second wave of Bitcoin thefts tied to the Coldcard wallet vulnerability, raising total losses to 1,158.81 BTC worth about $75.1 million. According to Galaxy Research, the two attacks struck 2,673 addresses between July 30 and July 31, while all stolen funds remain untouched across seven attacker-controlled wallets. Researchers also warned additional attacks remain possible.
According to Galaxy Research, the first attack stole 1,082.65 BTC from 1,195 addresses within 41 minutes on July 30. A second operation began about 27 hours later and drained another 76.16 BTC from 1,478 different addresses over three hours and 42 minutes.
Researchers said the two victim groups shared no overlapping addresses. They added that the second attack reached more wallets but targeted much smaller balances than the first campaign.
Galaxy Research also found different transaction fee patterns between both attacks. The first wave consistently used 30 sat/vbyte fees, while the second mainly used 10 and 50 sat/vbyte, with several smaller transactions using about four sat/vbyte.
According to Galaxy Research, all 1,158.66 BTC remains unspent across seven attacker-controlled addresses. Researchers said the lack of movement is unusual for a theft of this size.
The firm added that any transfers into exchanges or mixing services would become the next major development. It also noted that engineers at Block may have uncovered identifying information connected to the suspected attacker.
Meanwhile, Galaxy Research said its tracking method relies on transaction fingerprints rather than the vulnerability itself. Researchers warned future attackers could avoid detection by changing transaction fees, adding change outputs, using separate destination addresses, or spreading transfers over longer periods.
Galaxy Research urged users with affected single-signature Coldcard-generated wallets to move funds to newly generated wallets immediately. However, it said multisignature users remain protected if Coldcard devices alone cannot authorize transactions.
Galaxy Head of Research Alex Thorn also alleged that a hacker converted part of a victim's stolen Bitcoin through THORChain into Ether before depositing about 229.72 ETH into Duel Casino. Thorn said the victim and a researcher requested a freeze, but the platform advised contacting police.
Separately, Binance founder Changpeng Zhao, known as CZ, said firmware updates cannot protect previously generated self-custody wallets. He added that users must move affected funds because developers cannot access air-gapped devices or update existing wallet seeds.
The post Coldcard Bitcoin Theft Tops $75M as Galaxy Research Identifies Second Attack Wave appears on Crypto Front News. Visit our website to read more interesting articles about cryptocurrency, blockchain technology, and digital assets.
