Galaxy Research has nearly doubled its estimate of losses from a Coldcard hardware wallet exploit, now putting the toll at roughly $70 million drained from 1,196 addresses on July 30. Coinkite has released a hotfix, but it does not protect seeds already generated on vulnerable firmware. Binance founder Changpeng Zhao is urging holders to split funds across multiple wallets in response.
Galaxy Research, the research arm of Galaxy Digital, has raised the estimated scope of the Coldcard wallet exploit to 1,082.65 Bitcoin, worth about $70.2 million at the time of the transactions, pulled from 1,196 addresses. That is nearly double an earlier estimate, and it has renewed debate over how secure self-custody through a hardware wallet really is.
Loss estimate expands after Galaxy Research review
Galaxy Research traced the Bitcoin movements between 1:10 a.m. and 1:51 a.m. UTC on July 30 across blocks 960,183 to 960,191, about 30 hours before Coldcard published its first security advisory. That figure builds on an earlier estimate from AnchorWatch CEO Rob Hamilton, who had put the toll at 594.48 Bitcoin, worth around $38 million, moved across 500 transactions within a three-block window. Galaxy Research said the flagged transactions shared identical 30 satoshi-per-virtual-byte fees and no change outputs, though it cautioned future attacks against Coldcard-generated addresses may not follow the same pattern.
A firmware bug dating back to 2021
The attacker exploited a firmware flaw dating to March 2021 that weakened the randomness used to generate recovery seeds on certain Coldcard models. By reconstructing private keys offline, the attacker drained funds without ever physically accessing the devices. Many of the affected wallets had sat dormant for years.
Coinkite's hotfix does not cover old seeds
Coinkite co-founder Rodolfo Novak said the company takes responsibility for the firmware bug and is working to determine the full scope of the issue. Novak said Coinkite released a hotfix to remove the software fallback path, but the update does not protect seeds generated on vulnerable firmware. Users who generated seeds on affected versions must therefore create an entirely new seed phrase on a patched device and migrate funds across.
CZ tells holders to split their funds
Binance founder Changpeng Zhao, known as CZ, responded to the theft by urging crypto holders to spread funds across multiple wallets. In a post on X, CZ said: "Even hardware wallets can have bugs." Hardware wallets are widely viewed as one of the strongest options for securing bitcoin offline, yet the Coldcard case shows even long-established devices can harbor critical flaws that go undetected for years.
Sources: CoinDesk, Cointelegraph
Trading involves risk.
Risk Disclaimer
