Bitcoin Holders Lose $88,600,000 in Coldcard Crypto Wallet Exploit: Galaxy Researchers - The Daily Hodl FEATURES News
Bitcoin Ethereum Altcoins Financeflux Trading NFTs Blockchain Futuremash Regulators Scams, Hacks & Breaches
INDUSTRY ANNOUNCEMENTS Latest Press Releases Chainwire Sponsored Posts Submit Your Content CRYPTO MARKETS SUBMIT Guest
Post Press Release Sponsored Post Advertise No Result View All Result FEATURES News Bitcoin Ethereum Altcoins
Financeflux Trading NFTs Blockchain Futuremash Regulators Scams, Hacks & Breaches INDUSTRY ANNOUNCEMENTS Latest
Press Releases Chainwire Sponsored Posts Submit Your Content CRYPTO MARKETS SUBMIT Guest Post Press Release Sponsored
Post Advertise No Result View All Result No Result View All Result Bitcoin Holders Lose $88,600,000 in Coldcard Crypto
Wallet Exploit: Galaxy Researchers by Daily Hodl Staff August 3, 2026 in Bitcoin, Scams, Hacks & Breaches Crypto
researchers say Bitcoin investors have now lost more than $88 million to an exploit in the Coldcard hardware wallet.
Researchers at Galaxy say BTC is being drained from addresses by bad actors in waves, due to a firmware bug that
dramatically reduced the randomness of how the wallet creates its secret recovery phrase. “A 3rd wave in what we
suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained. Our
estimated observed size of the Coldcard hack is now 1,367.05 BTC (~$88.6m) across 4,585 addresses… Waves 1 and 2
followed similar patterns: the same funnel topology into a handful of shared collectors, the same P2WPKH destinations,
the same mix of derivation paths, 27 hours apart. Treating them as one operator is reasonable, but it rests on
resemblance, not on proof, and they already differ in two respects — the fee constant, and whether the sweeps signal
replace-by-fee. Even if we can assume Waves 1 and 2 are the same attacker, Wave 3 should not be assumed to be the same
operator. It differs from both earlier waves on every behavioural axis we can measure: it abandons the shared collector
for one destination per victim, it holds in P2WSH rather than P2WPKH, it batches an average of 6.37 victims into each
sweep where wave 1 took exactly one, and it scans only the default derivation path. It may be the same actor with
rebuilt tooling — the anti-clustering design is exactly the evolution one would predict after waves 1 and 2 were
enumerated — or it may be a second actor working the same vulnerable key space independently, which the published
disclosures make entirely feasible. The chain does not distinguish these, nor can we… The loss profile is
dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual
self-custody, not institutional holdings. The vulnerable Coldcard firmware shipped on March 17, 2021 around block
674,951. Not one of the coins we have identified in Waves 1-3 taken was created before that block.” The theft has
triggered a scramble among Coldcard users to protect their funds. Galaxy researchers say some initial addresses came
from victim reports on X and were used to map the on-chain patterns. They warn that this data is derived solely from
analyzing Bitcoin block data and the unspent-output set, and they have not used compute to confirm whether the addresses
identified as possible victims were actually generated with low entropy. Follow us on X, Facebook and Telegram Don't
Miss a Beat – Subscribe to get email alerts delivered directly to your inbox   Disclaimer: Opinions expressed at
The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk
investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your
own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling
of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl
participates in affiliate marketing. Generated Image: DALLE3 Submit a Press Release Industry Announcements Bybit
Launches New DCA Challenge with Up to 55,000 USDT in Rewards for BTC, ETH and XAUT Auto-InvestingJuly 29, 2026 Bybit
Introduces Finloop’s FUIDL backed by an AAA-rated Money Market FundJuly 29, 2026 Canton’s Decentralized App Layer
Launches, Backed by $1M+ Foundation GrantJuly 28, 2026 EMCD launches Miner Support Program with up to $30M for miners
amid industry’s steepest profitability squeezeJuly 27, 2026 RISEx Launches ‘Ignite’ Season 1 Points
Program, Following $3B in Volume During the Early Access PhaseJuly 24, 2026 CoinRabbit and GoMining Report: Managing
Bitcoin Matters More Than Mining VolumeJuly 23, 2026 Adam Weitsman Backs Unserious in their Acquisition of Creepz and
Psychrome homecomingJuly 22, 2026 Submit a Guest Post ADVERTISEMENT Spotlight Claude AI User Conversations Surface
Publicly via Google SearchesAugust 1, 2026 Oregon Caregiver Indicted on Felony Charges for Neglecting Elderly Medicaid
Recipients and Submitting Fraudulent BillsAugust 1, 2026 345,000 Americans Warned Following CareCloud AWS Breach,
Sensitive Personal, Financial and Medical Records at RiskAugust 1, 2026 Kansas Wealth Management Firm Data Breach
Potentially Exposes Client Names, Social Security Numbers and MoreAugust 1, 2026 DON'T MISS A BEAT Crypto headlines
delivered dailyto your inboxBTC, ETH, XRP news alert options By joining The Daily Hodl news list you agree to our Terms
and Conditions and Privacy Policy. Featured Image: Shutterstock/Billion Photos Covering the future of finance, including
macro, bitcoin, ethereum, crypto, and web 3. Categories Bitcoin • Ethereum • Trading • Altcoins • Futuremash
• Financeflux • Blockchain • Regulators • Scams • HodlX • Press Releases ABOUT US | EDITORIAL
POLICY | PRIVACY POLICY TERMS AND CONDITIONS | CONTACT | ADVERTISE JOIN US ON TELEGRAM JOIN US ON X JOIN US ON FACEBOOK
COPYRIGHT © 2017-2025 THE DAILY HODL No Result View All Result FEATURES News Bitcoin Ethereum Altcoins Financeflux
Trading NFTs Blockchain Futuremash Regulators Scams, Hacks & Breaches INDUSTRY ANNOUNCEMENTS Latest Press Releases
Chainwire Sponsored Posts Submit Your Content CRYPTO MARKETS SUBMIT Guest Post Press Release Sponsored Post Advertise ©
2025 The Daily Hodl