Coldcard Bitcoin loss estimate rises to $70M after Galaxy analysisGalaxy Research identified 1,196 addresses that lost 1,082.65 Bitcoin in a 41-minute window, expanding the estimated scope of the Coldcard wallet incident.
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-assisted summary based on the linked source. Verify market-moving details at the original publisher before acting.
Galaxy Research, the research division of Galaxy Digital, has identified 1,196 addresses involved in the Coldcard wallet security incident that lost a total of 1,082.65 Bitcoin. These losses occurred within a 41-minute window between 1:10 AM and 1:51 AM UTC on July 30, 2026, spanning blocks 960,183 to 960,191. At the time of these transactions, the Bitcoins were valued at approximately $70.2 million, significantly expanding earlier estimates of the scale of the breach.
Previously, an initial analysis by Rob Hamilton, CEO and co-founder of AnchorWatch, had estimated that around 594.48 Bitcoin—worth about $38 million—were moved across 500 transactions in a smaller, three-block window. Galaxy Research's more extensive investigation showed a distinct transaction pattern involving identical fees of 30 satoshis per virtual byte and the absence of change outputs, which helped identify the initial attack on the Coldcard-generated addresses. However, the research team cautioned that future exploits might not exhibit the same on-chain characteristics.
Rodolfo Novak, co-founder of Coinkite—the company behind Coldcard wallets—acknowledged responsibility for the firmware vulnerability and stated that the firm is actively working to assess the full extent of the problem. Coinkite has released a hotfix patch to eliminate the software fallback path linked to the exploit but warned that this update does not secure wallets or seeds generated on the compromised firmware. Users who created their seeds with the vulnerable software are advised to move their funds to new wallets generated by updated firmware.
This development matters because the Coldcard wallet is widely used for secure Bitcoin storage, and the breach represents a substantial financial loss with implications for wallet security and user trust. Galaxy Research's expanded analysis provides a more complete understanding of the incident's scope, while Coinkite's response highlights ongoing efforts to mitigate harm and prevent further exploitation.