Coldcard Losses Top $100 Million. A Fourth Wave Could Push Damage to $130 Million.

Coldcard losses passed $100 million, and the estimate is still moving

Galaxy Research now counts 1,596 BTC stolen across three confirmed waves. If a suspected fourth wave is verified, the total could rise to about 2,055 BTC, or nearly $130 million.

The clearest single burst came on July 30, when an attacker swept 1,082.65 BTC from 1,196 addresses in 41 minutes in activity tied to a Coldcard firmware flaw. That burst was worth about $70.2 million at the time. What began near $70 million is now tracking toward nearly $130 million, so investors have to reprice the event as it develops rather than wait for a final tally.

Market reaction may arrive before the loss count does. Bitcoin social sentiment fell to some of its most negative readings on record. That does not make this equivalent to FTX, and bears can still argue it is a hardware-wallet-specific hit. But if the fourth wave checks out, the incident is becoming hard to treat as a niche security headline.

Why the exploit keeps working

The vulnerability was in seed generation, not Bitcoin itself

The root cause was a March 2021 firmware integration error that routed seed generation to a software pseudorandom number generator instead of the STM32 hardware RNG. In practical terms, that means an attacker with enough information about device state could generate candidate seeds offline and test whether their derived addresses appeared on-chain.

That is very different from breaking Bitcoin's cryptography. The attack depends on weak randomness in affected wallet firmware, not a protocol-level flaw.

Why a fourth wave matters to markets

Galaxy said waves one and two followed similar funnel topology, shared collector behavior, the same P2WPKH destinations, and the same mix of derivation paths. The same analysis also says that attribution rests on resemblance, not proof. That distinction matters: markets start pricing a live exploit long before investigators have definitive actor-level confirmation.

Wave three added another shift: targeting smaller balances. That does not prove a new attacker, but it widens the pool of potentially affected users. If smaller wallets are in scope, the address space under pressure looks larger than the headline victims alone.

The market impact depends on trust as much as supply

Confirmed losses are already 1,596 BTC across three waves, with a possible fourth wave pushing the total toward 2,055 BTC. The more immediate market question is not whether 2,000 BTC suddenly hits spot demand. It is whether self-custody confidence weakens further while the incident is still unfolding.

Why this is still a warning shot more than a clean short on BTC

Around 90% of the stolen Bitcoin remains unmoved. That limits the direct sell-pressure argument and makes this more of a timing-and-nerve trade than an instant BTC dump.

What could change that dynamic is visibility and coordination. Galaxy says investigators have shared attacker and victim addresses with U.S. law enforcement agencies, exchanges, and cyber investigation groups. If that leads to fresh victim alerts, exchange action, or signs that flagged coins are becoming tradable again, dormant balances could stop looking dormant for long.

The timeline may also be tighter than investors expect. Galaxy warned that pending transactions signal replace-by-fee, so anyone who spots their address in the mempool may have only minutes to act. New sweeps can therefore arrive in sharp bursts rather than after a long buildup.

• Bearish triggers: a fourth wave is confirmed, more victim clusters emerge, flagged outputs become movable, or mempool activity shows aggressive fee-bumping.
• Invalidation signals: Galaxy finds no new clusters, the suspected fourth wave does not validate, and stolen outputs remain dormant.

If confirmation and sweep speed rise together, the likely read-through is sharper fear in BTC futures and weaker risk appetite across smaller crypto assets. If the incident stays dormant and no new clusters emerge, any initial sell-the-news fade should fade with it.

The user fix is migration, not just an update

Installing the update does not protect an existing seed. The practical rule is simple: generate a fresh seed on patched firmware and move funds. Restoring an old seed elsewhere carries the same weakness forward.