Galaxy Research reports 1,596 BTC stolen, with 90% of funds unmoved and a potential fourth wave pushing losses to $130 million.
Bitcoin theft linked to Coldcard wallets has exceeded $100 million, with 1,596 BTC stolen from approximately 7,300 addresses across three major attack waves and 14 smaller incidents. The losses were confirmed by victim reports and forensic analysis by Galaxy Research.
The research group identified a suspected fourth wave that could increase total losses to 2,055 BTC, worth about $130 million. However, this wave remains unconfirmed due to a lack of victim reports. About 90% of the stolen Bitcoin has not been moved, including funds from the first three confirmed attacks.
Attacker and victim addresses have been shared with U.S. federal law enforcement, crypto exchanges, and cyber-investigation firms. The findings update Galaxy’s earlier estimates and highlight ongoing risks in crypto wallet security.