Coldcard Crisis Deepens: Galaxy Links $89M BTC Theft to 15+ Attackers After 12-BTC Tip

Galaxy's latest numbers still point to an unfolding incident

This is no longer just a post-breach update. The quantified damage is already 1,367.05 BTC, approx. $89 million, and Galaxy has flagged two additional suspected waves after the first strike. More important, the activity still looks ongoing, which keeps the episode in the live-incident category: continued outflows, continued wallet migrations, and continued pressure on Bitcoin market plumbing.

That matters because the event was not confined to stolen balances. Galaxy described the largest on-chain movement of small Bitcoin transactions since the FTX collapse. The broader implication is simple: when holders rush to move funds away from vulnerable setups, on-chain metrics become noisier and some of that forced motion spills into exchange-ready balances.

Why the drain kept repeating after the first wave

The Coldcard exploit was not a one-off breakout. Galaxy traced the flaw to insufficient randomness in seed phrase generation. In practical terms, that means vulnerable wallets remained predictable over time, so attackers did not need a single spectacular exploit to keep profiting. The damage could keep compounding as more at-risk wallets were identified and drained.

The second wave showed the same pattern on a larger scale

The second wave alone hit 709 suspected victim addresses and moved 448.7 Bitcoin. Galaxy said the activity ran at roughly 45 times the normal sweep rate. That helps explain why losses kept climbing even after the first attack became public.

The same pattern also explains why users continued to lose funds after the initial incident was widely reported. The exploit did not exhaust the pool of vulnerable wallets; it exposed how large that pool was.

Why tracing the stolen funds is so difficult

The transfer pattern was fragmented rather than centralized. According to Galaxy, attackers mostly created a new destination address for each victim instead of funneling coins into one drop wallet. That makes the money trail harder to compress into a small set of watchlists.

It also means the cash-out path is becoming harder to predict. Galaxy said some of these funds have already swept into second-hop addresses. That does not prove a large sell event is imminent, but it does suggest the flow is moving beyond the first hop.

User migration is adding another layer of market friction

The pressure is not only coming from attacker behavior. Some affected users are getting someone to help them get their seed restored into a hot wallet and send to an exchange for the time being. That matters because coins sitting on exchanges are closer to sell liquidity than coins kept in cold storage.

That dynamic helps explain why even relatively small, fragmented losses can still matter. A 12 BTC migration from a single wallet may seem modest on its own, but if more users move funds the same way, the market absorbs extra supply through migration rather than through a coordinated dump.

The market debate is now about pressure type, not just loss size

The bear case: trust damage can linger

Bears can argue that the incident hurt more than balances; it also hit confidence in self-custody workflows. Galaxy said the vulnerability significantly dampening market sentiment. That kind of damage can last longer than the initial flow shock if holders start rethinking how they store Bitcoin.

The distribution of migrated funds also matters. When users move assets to exchanges "for the time being," some of the stress leaks into a more sellable part of the system. That does not guarantee a large sell-off, but it does mean traders have to assume migration flow can turn into exchange float faster than bulls prefer.

The bull case: the forcing move may be peaking

Bulls, however, have a real counterargument. The stolen coins are not sitting in one obvious balance waiting to hit the market. some of these funds have already swept into second-hop addresses, which complicates recovery but also makes the supply signal less clean.

There is also a case that the attack tempo may be slowing. Galaxy flagged another wave of sweeps, but the emerging picture is one of repeated waves rather than a single accelerating surge. If that deceleration holds, the worst of the forced-motion window may be passing even if the reputational hit remains.

What to watch next

The key fork in the story is straightforward: - If fresh sweep activity fades, the market may absorb the incident mainly as a confidence shock. - If exchange-bound migration keeps building, the sell-side pressure becomes more tangible. - If doubts about self-custody persist, investors may look for alternatives, including whether managing private keys has become too risky for everyday investors.

For now, the most important variable is not just how much was taken, but whether the flow of vulnerable coins into tradable balances is still increasing or starting to taper.