Galaxy Warns of 1,082 BTC Lost in Coldcard Sweep-Why Bitcoin Sentiment Could Still Slip

Galaxy Research expands the Coldcard loss estimate

Galaxy Research now traces 1,082.65 BTC across 1,196 addresses, worth about $70.2 million at the time of the transactions. The movement happened in a 41-minute window, turning what began as a wallet-security incident into a broader market-trust concern.

The late warning matters for sentiment

That burst of activity occurred between 1:10 AM and 1:51 AM UTC on July 30, about 30 hours before Coldcard published its first advisory. In crypto, a delayed warning can matter as much as the loss itself because it suggests the vulnerability was live longer than users and traders realized.

Why this hit dormant Bitcoin, not just active wallets

This was not an exchange breach or a phishing loss. Affected wallets included many that had been dormant for years, which is exactly what makes the incident so damaging to the idea of cold storage. If funds can be swept from old Coldcard wallets created during the window when the flaw existed, the safety label stops sounding automatic.

Bears will argue this remains a device-level problem, not a Bitcoin protocol problem. That is fair. But markets often move on the perceived exposure before the boundaries are fully settled. The near-term watchpoints are whether affected users rush to move vulnerable seeds and whether counterparties respond with more caution around incoming UTXOs.

The root cause was weak entropy, not stolen hardware

Galaxy's estimate kept rising because the issue was not a one-off theft. It was a seed-generation bug that made private keys guessable through brute force, rather than the result of phishing, malware, or physical access.

Coldcard entropy fell far below the intended 128 bits

Coinkite said the problem came from a build error that weakened randomness during seed creation. On Mk3 devices, that reduced entropy to just ~40 bits. That is still far too low for security, which is why old wallets created under those conditions were not protected simply by being offline.

The important point is that the flaw applied to seeds generated during the affected firmware window, not just to devices found recently. That helps explain why the loss map kept expanding as analysts identified more affected addresses.

The July 31 firmware fix did not erase prior exposure

Coinkite released hotfix firmware on July 31, 2026 for Mk, Q, and Mk3. That reduces the risk going forward, but it does not restore entropy to seeds already created on vulnerable firmware.

As a result, losses could still climb as more affected addresses are identified. The fix prevents repeat exposure; it does not reverse damage already done to earlier wallet setups.