Coldcard Suffers $88M Bitcoin Theft as Stolen Coins Flood Exchanges

Coldcard losses have climbed to roughly $88.6 million as the exploit continues

Galaxy Research says the theft is still underway

This is not a closed hack. Galaxy Research says the theft is still active and its observed tally has now reached roughly $88.6 million across the latest wave of drains. The firm is tracking about 1,367 BTC moved from 4,585 addresses, including a third wave that added 207.73 BTC. As long as new wallets are being emptied, the market has not fully absorbed the hit.

The bigger concern for investors is not only the stolen Bitcoin itself, but what holders are doing next. Some affected users are moving funds off self-custody and back onto centralized exchanges or into new addresses. If that trend spreads, exchange balances can rise and trust in self-custody can weaken. For now, the key point is simple: the exploit is still happening, and the total can still climb.

The Coldcard flaw weakened the security promise of hardware wallets

The July 30 breach hit during a 41-minute window between 1:10 and 1:51 AM UTC, and at the time it was blamed for roughly 1,082.65 BTC worth about $70 million. That speed matters because it was not a slow drain from obscure vaults. It was a fast, concentrated attack on devices marketed as one of the safest places to store Bitcoin.

What actually broke in Coldcard devices

The issue was not a compromised computer or a stolen password. It was how Coldcard Mk3 devices generated recovery seeds. A firmware flaw present in those devices since March 2021 weakened the random-number generation used to create seeds, making them less random than intended.

That is the real security break. If seed generation is easier to guess, the whole offline-wallet premise becomes vulnerable. The newer Mk4, Q, and Mk5 models were not affected by this flaw, but that does not erase the damage to confidence in the product line.

Why the fix is more than a firmware update

Coinkite released patched firmware in version 4.2.0 and above, but the advisory made one thing clear: updating firmware alone does not restore safety. If a wallet was created with a compromised seed, that seed remains vulnerable wherever it is used. Affected users need to generate new seeds on patched hardware and move funds to fresh addresses.

That is why the fallout is affecting more than just Coldcard users. Some holders are sending Bitcoin back to exchanges for temporary safety, with bitcoin driving back onto exchanges as holders seek temporary safety. Others, following CZ, are choosing to split funds across multiple wallets to reduce reliance on any single device, even though that approach adds complexity.

Bitcoin price risk now depends on attacker behavior and holder reactions

The near-term price risk is not only the theft itself. It is the combination of parked stolen coins and changing user behavior: the stolen funds from the three documented waves remain parked in attacker addresses, while affected holders are already driving bitcoin back onto exchanges for temporary safety. If the stolen Bitcoin stays dormant, the event may prove more damaging to trust than to price. If those wallets become active, the market has to price a new wave of forced supply.

What to watch next

• Setup: Stolen Bitcoin is still sitting in attacker addresses, but investors are already moving funds toward exchanges and new wallets.
• Trigger: Price pressure increases if the parked coins start moving, especially into exchanges or other tracked venues.
• Invalidation: If the coins remain dormant, exchange inflows normalize, and holders stop rushing to move funds, the fallout looks more like a credibility event than a sustained sell-pressure event.

For now, the clearest watchpoint is on-chain activity. This is a short-to-medium-term risk for Bitcoin if stolen coins stay idle but confidence keeps eroding; it becomes a larger market problem only if those funds start moving.