Coldcard Wallet Hack Crosses $115M, Attack Still Ongoing Losses from the Coldcard wallet hack have now crossed $115 million, according to Galaxy Research. Alex Thorn, who heads firmwide resea
Losses from the Coldcard wallet hack have now crossed $115 million, according to Galaxy Research.
Alex Thorn, who heads firmwide research at Galaxy, said on X that the attack is "still ongoing" as more victims report losses and additional waves get confirmed. 
It started around July 30, 2026, and it's already shaping up to be one of the biggest hardware security failures in recent crypto news.
The root issue is a firmware flaw in Coinkite's devices. It let attackers recreate seed phrases that were originally generated on the affected hardware.
Once someone reconstructs a seed, they don't need your device or any action from you; they can just rebuild the private keys and drain the directly.
Galaxy Research isn't describing this as a one-off breach either. Their read is that it's a systematic, on-chain sweep across vulnerable addresses, which is exactly why the total keeps rising wave after wave.
The figures below are based on updates and estimates reported by multiple sources tracking the Coldcard wallet hack, including Galaxy Research, Alex Thorn, and blockchain security firms.
Because the investigation is ongoing and new victim addresses continue to be identified, the reported totals may vary between sources.
Update
Estimated Loss
Notes
Early confirmed tally
$100 million
Based on ~1,596 BTC across 7,300+ addresses
Alex Thorn's latest update
$115 million+
Described as "still ongoing"
Suspected total (Wave 4 unconfirmed)
Up to $130 million
Still waiting on victim confirmation
There's a bit of good news buried in here: Galaxy says about 90% of the stolen coins are still sitting untouched and traceable, so recovery isn't completely off the table for those affected.
Coinkite has confirmed the vulnerability touches the following:
Coldcard Mk3, Mk4, and Mk5 devices
Coldcard Q hardware wallets
Any seed generated on the flawed firmware before the emergency patch went out
The Coldcard wallet hack isn't just a Coldcard problem anymore, though. It's reignited a bigger conversation about how solid firmware-level security really is across hardware wallets in general.
An emergency firmware patch is already out, and Coinkite says it's destroyed whatever vulnerable inventory was left in stock so new units don't ship with the broken code.
Meanwhile, Galaxy Research is working with victims directly, tracing the stolen funds on-chain and passing attacker and victim wallet data to law enforcement and exchanges to help with recovery.
People watching this closely say it exposes a real weak spot in how hardware wallets are built: firmware bugs can undercut even a fully offline, self-custody setup, no matter how careful the user was.
Some think this could push more people toward multisig wallets or manual entropy methods like dice-roll seed generation, neither of which was affected here.
It might also mean hardware wallet makers face tougher scrutiny over how they audit firmware going forward, not just Coinkite.
Disclaimer: This article is for informational purposes only and isn't financial or investment advice. Crypto holdings carry risk, so it's worth verifying wallet security on your own before acting on anything here
