Galaxy Research has just confirmed that the official losses from the Coldcard hardware wallet exploit have now surpassed the $100 million mark. A total of 1,596 BTC was stolen from around 7,300 user addresses through three major waves and 14 small-scale attack incidents.
However, this theft figure continues to grow.
Fourth Wave and Idle Stolen Coins
A fourth wave of attacks has now been identified, draining 448 to 449 BTC from 709 additional addresses. This addition brings the estimated total losses to 2,055 BTC, valued at approximately $130 million. Although there has been no confirmation from victims on whether the operator behind this wave is the same entity, Galaxy expressed medium-high confidence that this activity originates from the identical attacker group. So far, 73 victims have directly contacted Galaxy researchers to confirm the loss of their assets.
There is one strange pattern in this series of hacking actions: 90% of the stolen Bitcoin has not been moved by the perpetrators at all, including all the coins from the three confirmed initial waves. The hacker’s wallet addresses and the list of victims are no longer a secret. Galaxy has shared this address data with US federal law enforcement, several crypto exchanges, and cyber investigation firms. On the X platform, a report from the on-chain analytics account @lookonchain summarizing more than 7,700 victim addresses spread widely and gathered 539 likes.
Panic Among Old Coin Holders
This exploit stems from a security loophole caused by a build error in the firmware that has apparently been latent since March 2021. The fact that this vulnerability lay hidden for three years immediately triggered panic among long-term Bitcoin holders. A Bitcoin wallet starting with prefix 18TExP that had been dormant for 12.6 years suddenly woke up and moved 500 BTC worth $31.3 million. This movement is strongly suspected to have occurred as the owner panicked in response to the series of reports about Coldcard breaches.
Data from CryptoQuant reinforces this flight trend of old coins. Around 935 BTC from coins dormant for over 10 years moved addresses on August 3, marking the largest movement volume of old coins since March 20. Previously, around 6,388 BTC from the group of wallets aged five to seven years also moved on July 31. Despite the shadow of the Coldcard exploit, the price of Bitcoin actually held its ground, rising close to $64,000, followed by Solana which rose 1% to $74 and the token HYPE which went up 4% to $54.
Urgent Security Steps
Galaxy confirmed that this attack is still ongoing. For Coldcard owners who are unsure about the security level of their device, the safest option at this time is to immediately migrate funds to alternative storage. Delaying preventive action will only give the hackers extra time to make your wallet a victim in the next wave of attacks.
As reported by Cointelegraph.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
