A coordinated campaign targeting Coldcard hardware wallet users has resulted in confirmed Bitcoin losses exceeding $100 million across three distinct attack waves, according to research published by Galaxy Research. The findings mark one of the most consequential hardware wallet security breaches in the history of self-custody Bitcoin storage — and investigators warn the worst may not yet be over, with a suspected fourth wave under active examination that could push total losses to $130 million.
What makes the Coldcard case particularly striking is not merely the scale of the theft, but the apparent restraint of those responsible. Galaxy Research's analysis found that roughly 90% of the stolen Bitcoin has not moved since it was taken — sitting dormant in wallets that investigators continue to monitor. In the world of cryptocurrency theft, where proceeds are typically laundered through mixers, decentralized exchanges, or cross-chain bridges within hours or days, this degree of inaction is highly unusual. It suggests either a sophisticated actor with a long-term laundering strategy, an operational pause while law enforcement pressure mounts, or — in a scenario that would raise further questions — the possibility that some stolen funds may be inaccessible even to the attackers themselves.
The "wave" structure of the attack is itself significant from a forensic standpoint. Serial attack campaigns of this nature — rather than a single breach event — suggest a methodology that was refined and repeated over time. Each wave likely targeted a discrete cohort of victims, potentially exploiting a consistent vulnerability in key generation, seed phrase exposure, or supply chain compromise. Coldcard, manufactured by Coinkite, is widely regarded as one of the most security-hardened hardware wallets available to retail and institutional Bitcoin holders, making the breach — however it was executed — a watershed moment for the self-custody security industry.
The suspected fourth wave, if confirmed by investigators, would represent an escalation that brings aggregate losses to an estimated $130 million. That figure would place this series of attacks among the largest Bitcoin-specific theft campaigns on record, rivaling exchange hacks that have historically dominated headlines. The distinction here is that hardware wallets exist precisely to prevent the class of attacks that compromise hot wallets and centralized custodians. When cold storage itself becomes the attack surface, the implications for institutional adoption of self-custody strategies are substantial.
From a regulatory and compliance perspective, the dormant state of the stolen funds creates both an opportunity and a complication. On one hand, blockchain analytics firms and law enforcement agencies have an extended window to tag, track, and potentially intercept the funds before they move. The Federal Bureau of Investigation and international counterparts have successfully recovered substantial portions of stolen cryptocurrency in previous high-profile cases — most notably the partial recovery of funds from the 2016 Bitfinex hack — when stolen assets remained stationary long enough for legal action to catch up. On the other hand, the sheer number of affected wallets and the wave-based attack structure complicate victim identification and jurisdictional coordination.
For the broader Bitcoin ecosystem, the Coldcard episode arrives at a delicate moment. Institutional interest in Bitcoin as a treasury and reserve asset has accelerated over the past two years, with a growing number of corporations and sovereign wealth vehicles exploring direct Bitcoin custody rather than relying solely on qualified custodians. Hardware wallet security has been a central pillar of that narrative. Any erosion of confidence in cold storage solutions — particularly those as well-regarded as Coldcard — risks pushing institutional holders back toward centralized custodians, with all the counterparty risk that entails. It also hands ammunition to critics who argue that direct digital asset custody remains operationally immature for large-scale institutional deployment.
The Galaxy Research findings have not yet disclosed the specific attack vector, and Coinkite has not, as of the publication of this article, issued a public statement addressing the confirmed losses. The absence of a detailed post-mortem from the manufacturer will be closely watched by the security community. Disclosure of the vulnerability — whether rooted in firmware, physical supply chain interdiction, social engineering, or an undiscovered cryptographic flaw — is essential for affected users and for the industry's ability to implement preventive measures before any confirmed fourth wave compounds the damage further.
What This Means for Self-Custody Security
The $100 million threshold crossed by the Coldcard theft campaign is more than a numerical milestone. It signals that hardware wallets, long treated as the gold standard of Bitcoin security, are not immune to coordinated, sustained attacks capable of operating across multiple waves without triggering immediate detection. With 90% of stolen funds still unmoved and a potential $130 million total exposure on the horizon, the case will serve as a defining stress test for blockchain forensics, law enforcement cooperation, and the hardware security industry's transparency standards. Investors and institutions holding significant Bitcoin in cold storage should treat this episode as a prompt to audit key generation practices, verify firmware integrity, and reassess custody architecture — regardless of the hardware brand in use.
Written by the editorial team — independent journalism powered by Codego Press.