July 30 marked the beginning of a crisis for Coldcard users. In just 41 minutes that morning, attackers drained 1,082 BTC worth roughly $70 million from nearly 1,200 addresses. The wallets all traced back to vulnerable firmware running on the popular hardware wallet.

Galaxy Research now estimates the total damage at 1,596 Bitcoin stolen across three confirmed waves plus 14 smaller incidents. The figure keeps climbing. Initially reports suggested around $70 million in losses. Now the number sits above $100 million, with a suspected fourth wave potentially pushing it to 2,055 BTC or $130 million total.

The first wave hit hardest. July 30 saw that massive sweep. Two more followed within days. By August 2, researchers had traced roughly 1,367 BTC across 4,585 addresses in the second and third waves combined. The third attack targeted smaller balances, taking 208 BTC from nearly 2,000 wallets using different transaction patterns.

What made the theft possible was a flaw in how Coldcard's firmware generated recovery seeds. Researchers connected the affected addresses directly to vulnerable recovery seeds created by the device. Galaxy's investigation received reports from 73 victims, which helped confirm the attack waves and identify smaller transaction patterns.

Whether one attacker controlled all three waves remains unclear. Each wave looks internally consistent, suggesting a single operator per wave. But once the vulnerability went public, other bad actors may have started hunting for and draining vulnerable wallets on their own.

The company has not included the suspected fourth wave in its confirmed count because victim confirmation was insufficient for that group of transactions. That gap alone could represent another 459 BTC in undocumented losses.

Coinkite released a security advisory on July 30 after the initial attack surfaced. The firmware flaw exposed a generation of Coldcard devices to seed extraction. Installing an update does not protect existing seeds already generated by vulnerable firmware versions, meaning affected users face a difficult choice about wallet migration and recovery.

This article is informational only and does not constitute financial advice. Cryptocurrency investments carry significant risk, including potential total loss of funds.