Coldcard's $88.6M Selloff May Not Be Over: Galaxy Warns of a Fourth Attack Wave

Coldcard losses have already broadened beyond the July 30 burst

Galaxy has tied Coldcard losses to 1,367.05 BTC across 4,585 addresses, including a 1,082.65 BTC burst in 41 minutes on July 30. That alone is big enough to hit trust in self-custody products. The more important point is that a third wave of sweeps showed the operator kept hunting after the most obvious burst, leaving room for at least a fourth wave.

Why the attack can still spread

In simple terms, the flaw turned seed generation into something far less random than it should have been. A firmware bug routed seed generation to a deterministic software PRNG instead of the hardware RNG, with no fresh entropy after initialization. That allowed attackers to test candidate seeds offline. It also means that installing patched firmware does not repair a seed that was already generated under the buggy firmware.

What keeps the story alive

The stolen coins have largely stayed put, so this has been more of a trust shock than a flood of realized supply so far. But the more actionable risk is that the attacker has broadened the sweep and changed collection behavior. If a fourth wave arrives, more wallets could be drained before investors fully see it.

Galaxy's tracing shows changing tactics, not just a bigger total

The third wave matters because it points to evolving tactics. Galaxy flagged a third wave of sweeps, and its fund tracing also showed two distinct passes that expanded the victim set after the original July 30 burst. That does not guarantee another huge sweep, but it does suggest the operator was still refining how many wallets it could pick off.

The second pass was broader, not just quieter

The first pass drained 1,196 addresses in 41 minutes. The second pass took a further 76.16 BTC from 1,478 addresses over 3 hours and 42 minutes. That wider reach matters because the attack was no longer limited to the biggest balances. It spread across more addresses, including smaller ones.

Fee patterns suggest a methodical operator

Galaxy's tracing also showed changes in transaction fees across the sweeps. That kind of variation looks more like tuning for confirmation speed and dust spending than random panic movement. It is one more reason to treat the operator as still active and still optimizing collection behavior.

The market exposure is mostly a self-custody trust issue

Galaxy noted that the loss profile is dominated by sub-1 BTC addresses in count, while value is still driven by the larger wallets. That matches individual self-custody, not institutional or exchange holdings. So the main transmission channel is likely distrust in hardware-wallet and self-custody narratives rather than an immediate hit to exchange balances.

Still, the key boundary condition remains: no public report has reconstructed a victim's seed and matched it to a drained address. Until that happens, some investors may overreact to each new round of sweeps instead of treating it as circumstantial evidence.

The practical signal: old Coldcard seeds remain exposed until owners move

The clearest signal now is behavioral, not theoretical: coins tied to weak Coldcard seeds remain risky until owners prove otherwise by moving them.

Where the pressure lands first

The first impact is on trust in devices marketed as secure self-custody vaults. This was individual self-custody, not institutional or exchange holdings, so the immediate hit is reputational. The next question is whether new victim outflows create real sell pressure or simply pull dormant coins into safer wallets.

Emergency firmware helps new setups, not old seeds

Coinkite shipped emergency firmware, but that does not repair an already-exposed seed. Owners of affected wallets need to generate a new seed on patched firmware and move their funds. Until they do, those balances remain exposed while the attacker is still targeting smaller balances and adjusting collection behavior.

What to watch next

Bearish signposts - New outflows from previously untouched victim addresses, not just movement of already-flagged funds. - Stolen funds starting to move toward exchanges or mixers. - Another broadening in the attacker's collection pattern.

Bullish signposts - Affected owners patch, generate fresh seeds, and move funds quietly. - The stolen funds continue to remain largely dormant, keeping the issue focused on distrust rather than realized selling.

Hard invalidation - If public analysis finally reconstructs a victim seed and matches it to a drained address, the threat stops being speculative and becomes a cleanup trade.