Coldcard hardware wallet users lost over $100 million across three confirmed theft waves, according to Galaxy Research analysis. The investigation reveals 90% of stolen Bitcoin sits unmoved in attacker wallets, providing investigators a window to trace funds and potentially recover assets.
The attacks exploited Coldcard devices, which rank among the most popular hardware wallets for storing Bitcoin offline. Attackers gained access to private keys through a supply chain compromise or sophisticated attack vector that bypassed the wallet's security model. The three waves hit different user cohorts over a defined period, suggesting coordinated or copycat operations targeting the same vulnerability.
Galaxy Research flagged a suspected fourth wave currently under investigation that could push total losses to $130 million. The dormancy of stolen Bitcoin indicates attackers may be waiting for market conditions to shift or planning careful laundering through mixers and exchanges. This delay creates enforcement opportunities for law enforcement and blockchain analysts tracking the funds.
The Coldcard theft represents one of the largest hardware wallet security breaches in crypto history. It underscores vulnerabilities in the supply chain and firmware security, even for devices marketed as air-gapped and offline. The incident raises questions about Coldcard's security audits and whether the manufacturer disclosed the attack vector to users promptly.
Hardware wallet users typically consider their devices secure against exchange hacks and software wallets, making this breach particularly damaging to industry trust. Coldcard's parent company has not issued comprehensive guidance on whether firmware updates or new device versions address the underlying vulnerability.
The unmoved Bitcoin gives blockchain forensics firms and law enforcement time to map attacker addresses and coordinate with exchanges to block withdrawals if funds attempt to convert to fiat. The scale of the theft likely triggers scrutiny from regulators and could prompt mandatory disclosure requirements for hardware wallet manufacturers.