Coldcard Losses Pass $115 Million, Galaxy Research Data Shows

Galaxy Research said that Coldcard losses have exceeded $115 million, covering 1,778.58 Bitcoin (BTC) swept from 8,680 addresses since July 30, according to Galaxy data through August 13.

One new chart from the firm ranks the 10 largest sweep groups by transaction habits. However, most of the drained addresses still have no named owner.

Follow us on X to get the latest news as it happens

Coldcard losses have exceeded $115M (based on the price when coins were stolen)Galaxy Research has spoken with 200+ victims to support them and gather intelligence on the attackersThis thread contains additional charts and info 👇 pic.twitter.com/H2K141mugF

— Galaxy Research (@glxyresearch) August 16, 2026

Every Stolen Coin Postdates the 2021 Firmware Release

The flawed firmware was shipped on March 17, 2021, at block 674,951. Galaxy found no stolen coin created before that point.

Zero of 6,303 coins taken in the waves predate the release. The same holds for 3,598 dated addresses reported by victims. The earliest sits at March 22, 2021.

That boundary is the flaw’s own signature. Keys made on affected devices only exist after the release, so their coins do too.

Holding periods show the reach. Drained addresses had sat untouched for a median of 1,292 days, about 3.5 years. Meanwhile, Galaxy had warned of fresh attacks on August 3.

Wave 1 Took 61% in under an Hour

The latest tally pushes the hardware wallet loss above earlier counts. The opening sweep did the heaviest damage. 

Galaxy attributes $70.2 million, or 61% of the total, to Wave 1 alone. The pace even drew a warning from Binance Founder CZ.

The sweeps ran across nine blocks in 41 minutes. That operator paid a fixed fee of around 30 sat per vByte and drained one address per transaction.

It reached 1,195 addresses and sent the proceeds to four collector wallets. In contrast, Footprint E touched more addresses at 2,147, batching up to 795 into a single transaction.

Most of Wave 1’s haul has not moved. Of 1,082.65 BTC taken, 1,082.57 still sits in place. Footprint E moved nearly all of its 209.94 BTC, leaving 4.38.

Wave 3’s take rests differently. Attackers received it in ordinary wallets, but 207.73 BTC now sits in script-hash vaults.

Reporting still lags the chain data. Just 192 people have reported losses within the published total, totaling 714.81 BTC, or 40.2% of the Bitcoin taken. 

Individual reports run as high as 58.97 BTC, with a median near 1.03. The remaining 6,890 addresses, holding 1,063.76 BTC, have no owner attached.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights