Bitcoin losses linked to Coldcard vulnerability grow to $70 million, Galaxy Research says
Galaxy said nearly 1,200 addresses were drained of more than 1,000 BTC worth roughly $70 million tied to a Coldcard vulnerability.
Losses tied to a vulnerability in Coldcard hardware wallets have climbed to approximately $70 million, according to new research from Galaxy Research. The firm identified nearly 1,200 Bitcoin addresses that were drained in connection with the flaw, totaling more than 1,000 BTC. The findings represent a significant escalation in the scope of what was previously understood about the exploit's impact.
Coldcard is a widely used hardware wallet manufactured by Coinkite, regarded within the Bitcoin community as one of the more security-focused storage solutions available. Hardware wallets are designed to keep private keys offline and protected from remote attacks, making vulnerabilities in such devices particularly concerning for users who rely on them as a primary layer of asset protection. The specific nature of the Coldcard vulnerability has not been fully disclosed publicly, as is common practice during active incident response periods.
The scale of the losses raises broader questions about security standards across the hardware wallet industry. With over $70 million in confirmed losses spread across more than a thousand addresses, the incident underscores that even devices marketed for their security credentials can carry meaningful risks. Affected users and the wider self-custody community may face renewed pressure to audit existing wallet setups and consider migration strategies.
Observers will be watching for an official technical disclosure from Coinkite regarding the vulnerability's origin and scope, as well as any guidance for users who may still be at risk.
Source: The Block
