Coldcard Hardware Wallet Breach Swells to $1.16B, More Than 5,200 Addresses Drained

ChainCatcher reports that losses tied to the Coldcard hardware wallet incident have grown to roughly $1.16 billion, after attackers moved 1,816 BTC from more than 5,200 addresses. Galaxy Research said it has identified a fourth wave of transfers and updated its estimate for that wave to about 449 BTC. Alex Thorn, head of Galaxy Research, said the most recent activity appears consistent with a "fourth organized theft wave," with throughput reaching 13.8 transactions per block—around 45 times the pre-incident baseline. Galaxy's review suggests multiple groups may be scanning the compromised key space at the same time. Investigators have traced the issue to a 2021 firmware update affecting certain Coldcard devices that altered seed generation from a hardware-based random source to a predictable software-based pattern. Canadian manufacturer Coinkite is urging users who generated seeds on Coldcard devices to move funds to a new, secure wallet as soon as possible.