Coldcard Thefts Hit $88.6 Million-And the Suspected Third Wave May Not Be Done

Coldcard losses are already large, and the third wave is the real open question

The loss tally investors need to watch is already large: Galaxy has tied suspected Coldcard-linked sweeps to 1,367.05 BTC from 4,585 addresses, or about $88.6 million stolen. That is not the final balance sheet; it is the visible pool so far.

The event also does not look cleanly over. Galaxy found that two attacks followed similar patterns, while the third used a different method and remained active through yesterday. That leaves an open question: one operator may have adapted its collection method, or a second actor may have found the same vulnerable key space and started sweeping it as well.

There is also a boundary condition. Galaxy has not confirmed the exact cause, pointing instead to possible entropy flaws, supply chain risks, or side-channel leaks. That means the current figure should be treated as the observed damage to date, not necessarily the final exposure.

What is confirmed about the Coldcard sweeps

The July 30 burst is the clearest event

The cleanest fact pattern is the July 30 sweep: 1,196 Bitcoin addresses in 41 minutes, with 1,082.65 BTC taken. Galaxy tied that third wave to a firmware flaw in Coldcard, and Coinkite responded the next day with emergency hotfix firmware.

The guidance for users is specific

Coinkite's operating guidance is clear: Mk3 seeds created on firmware 4.0.1 through 4.1.9 should be treated as exposed unless the user added ≥50 dice rolls. For Mk4, Mk5, and Q devices before the fixed releases, entropy may still be as low as ~72 bits rather than the intended 128 bits.

What still has not been fully proved

Coinkite says the fault came from a March 2021 firmware integration error, but that does not mean every drain is tied to that exact bug in publicly confirmed fashion. Galaxy itself points to possible entropy flaws, supply chain risks, or side-channel leaks, and no definitive public evidence has yet matched a specific victim seed to a drained address.

That distinction matters. The firmware fix stops future bad key generation, but installing it does not repair an existing exposed seed. The remaining risk is less about headlines and more about whether affected users regenerate seeds and migrate funds quickly enough.

Why the Coldcard story could still matter for BTC flows

The headline loss is not the main market issue; the bigger question is whether affected holders create fresh selling pressure. The event also coincided with U.S. spot Bitcoin ETF outflows reached $265 million on July 31, which suggests the market was already sensitive to new supply or sentiment shocks.

From wallet risk to possible sell pressure

If owners of affected Coldcard wallets believe others may need to move quickly, some traders may choose to sell before that supply appears. Coinkite says affected users must regenerate seeds only with this version and then carefully move funds, while already-compromised seeds still need migration. In a thin tape, that can turn a security issue into exchange inflows and, potentially, sell pressure.

There is also a timing question. The market was approaching August 7, when miners were set to vote on BIP-110. If Coldcard-related migration hits around the same time as other positioning activity, buyers may have less room to absorb extra supply. Even so, the current loss pool is still small relative to Bitcoin's total stock, so this does not automatically translate into a structural rerating.

What traders should watch next

The practical edge is not guessing how scary the headline is. It is tracking whether the event stays contained or starts feeding real supply into the tape.

1. Another burst would matter more than the headline

The clearest signal is whether another sweep matches the July 30 pattern of 1,196 Bitcoin addresses in 41 minutes. If the attack is slowing, the market can absorb residual fear. If dense bursts continue, buyers have to price in faster supply.

2. Migration behavior matters more than rhetoric

The next tell is how owners act. Coinkite's guidance is to regenerate seeds only with this version and then migrate carefully. If movements stay small, scattered, and non-custodial, the flow hit should remain limited. A noticeable rise in exchange-bound transfers would be more concerning.

3. Fee patterns and smaller balances are useful clues

Fee behavior can offer a readout on whether the same attack logic is still active. Earlier reporting described a targeting smaller balances and changing how funds are collected onchain pattern, and Galaxy also noted the third wave shifted toward smaller holdings. If those signatures fade, the event is likely losing momentum.