Galaxy Lifts Coldcard Bitcoin Loss Estimate to $70M
Get the Finance newsletter
Daily finance — markets, central banks, M&A, the prints that move money. Free.
- Galaxy Research identified 1,196 addresses that lost 1,082.65 Bitcoin (~$70.2M) in the Coldcard wallet incident, expanding the estimated scope well beyond initial analysis.
- The Bitcoin movements were traced between 1:10 AM and 1:51 AM UTC on July 30 across blocks 960,183 to 960,191, roughly 30 hours before Coldcard published its first security advisory.
- AnchorWatch CEO Rob Hamilton had earlier estimated the loss at 594.48 Bitcoin (~$38M) across 500 transactions in a three-block window — less than half Galaxy's revised figure.
- Galaxy Research identified a transaction fingerprint: identical 30 satoshis per vbyte fees and no change outputs, but warned future attacks against Coldcard-generated addresses may not follow the same pattern.
- Coinkite co-founder Rodolfo Novak said the company takes responsibility for the firmware bug and released a hotfix removing the software fallback path.
- Novak warned the hotfix does not protect seeds generated on vulnerable firmware and advised affected users to move their funds to a new seed.
Why it matters: Hardware wallet users who generated seeds on vulnerable Coldcard firmware remain exposed even after the hotfix, per Coinkite's own co-founder — meaning the $70.2M figure could grow as more drained wallets surface. The on-chain fingerprint gives investigators a retrospective tracking tool, but Galaxy's caveat that future attacks won't share it means the exploit vector isn't fully neutralized by the patch alone.
