Galaxy Research Estimates Coldcard Hack Losses at 1,789 BTC; Majority of Funds Still Idle

Galaxy Research has published an estimate that a hack involving Coldcard bitcoin hardware wallets resulted in losses of 1,789 BTC, one of the most detailed tallies of the incident so far. Based on Galaxy's blockchain analysis, about 87% of the stolen bitcoin has remained unmoved since the theft. That equates to roughly 1,561 BTC still sitting in attacker-linked wallets. The remaining ~228 BTC appears to have been transferred or liquidated in some form. At bitcoin prices at the time of reporting, the stolen funds were valued at about $114 million. Coldcard is a hardware wallet built for offline (cold) storage of bitcoin, marketed to users who want to keep private keys off internet-connected devices. Hardware wallets are typically viewed as more secure than software wallets or exchange custody. A breach tied to a product designed for offline protection raises fresh questions about how the theft occurred, though Galaxy's figures did not specify an attack vector. If confirmed, the losses would rank among the larger hardware-wallet-related incidents in recent memory. The lack of movement in most of the stolen BTC is significant for tracking and potential recovery. Investigators often monitor stolen coins for early signs of laundering activity, including use of mixers, cross-chain bridges, or deposits to exchanges. Unmoved funds can signal that attackers are waiting for attention to subside or holding the assets for strategic reasons. Galaxy's research did not indicate whether law enforcement or the manufacturer had been formally notified, and it did not outline any response from Coldcard's developers. The underlying cause of the compromise—whether a firmware vulnerability, supply-chain issue, or targeted attack against specific users—was not addressed. Further technical disclosures from Coldcard or independent security researchers would likely be needed to clarify how the breach was executed. Market impact A theft of this size, even without immediate liquidation, adds a meaningful amount of bitcoin to the pool of coins with a known illicit history. If the unmoved 1,561 BTC ultimately enters circulation via exchanges or over-the-counter venues, it may attract heightened scrutiny from compliance teams and blockchain-forensics firms monitoring tainted addresses. The episode could also refocus attention on hardware wallet security more broadly, particularly among users and institutions that rely on cold storage as a primary safeguard. Any confirmed vulnerability in a widely used device could trigger firmware updates, device recalls, or shifts in custody practices among holders prioritizing self-custody. As analysts continue tracking the dormant funds, additional clarity on the breach and any recovery efforts will likely hinge on further disclosures from Coldcard and independent researchers. FAQ What is Coldcard? Coldcard is a hardware wallet designed to store bitcoin offline and protect private keys from internet-based attacks. How much bitcoin was stolen? Galaxy Research estimates losses at 1,789 BTC, worth roughly $114 million at the time of the report. What does it mean that 87% is unmoved? It indicates about 1,561 BTC remains in attacker-linked wallets and has not been transferred, sold, or laundered so far, based on blockchain tracking. Has the cause of the breach been confirmed? No. The available reporting did not detail the method, such as a firmware flaw or a targeted attack. Originally reported by AltcoinGordon; written by Ethan Mercer. Republished with permission. View the original on AltcoinGordon →