Coldcard Wallet Exploit Hits $88M as Third Wave Strikes
A third wave of thefts targeting Coldcard Bitcoin wallets has pushed total losses to roughly 1,367 BTC across thousands of addresses.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Galaxy Research identified a third wave of wallet drains linked to Coldcard hardware setups.
- Total stolen funds have reached approximately 1,367 BTC, valued around $88 million.
- The ongoing campaign has compromised at least 4,585 individual Bitcoin addresses.
Attackers targeting Coldcard Bitcoin wallets aren't stopping. Fresh data from Galaxy Research shows a third wave of thefts just hit, bringing total observed losses to roughly 1,367 BTC across 4,585 distinct addresses.
That puts the total stolen value at roughly $88 million. Automated drainers are still actively sweeping affected wallets, showing zero signs of letting up.
A Growing Drainer Campaign
Security analysts at Galaxy Research tracked this latest surge as the operators expanded their scope. The exploit targets users storing funds via Coldcard hardware units. What began as scattered, isolated balance drains has quickly turned into a systematic, multi-wave campaign.
Thousands of individual holders are paying the price. With 4,585 addresses drained clean so far, the perpetrators are methodically siphoning off funds as soon as they locate vulnerable configurations.
Why it matters
Hardware wallets are supposed to be the gold standard for self-custody. When a premier cold storage device faces an exploit on this scale, it undermines the core assumption that off-exchange storage guarantees safety. If you hold Bitcoin on a Coldcard, check your addresses immediately and audit your setup for compromised keys.
Source: Decrypt
Top Crypto Casinos Right Now
🇮🇳 Showing sites that accept players from India Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
SIGN UP BONUS 150%
- Taking bets since 1996, same owners the whole way
- Sportsbook, casino and poker on one balance
- Bitcoin out in 1–24 hours
Why we chose it: Thirty years of paying people, no ownership shuffles, no mass-confiscation scandal. You trade crypto choice and a modern interface for that.
More info Less info
- Online since
- 2011
- Licence
- Curaçao
- Min deposit
- $25
- Payout time
- 1–24 hours (crypto)
- KYC
- Required
Restricted countries: Australia, Austria, Germany, United Kingdom, France, Slovakia.
1st Deposit Bonus €500
- Withdrawals in 5–30 minutes
- $1 minimum deposit, 11 coins
- Esports depth nothing else here matches
Why we chose it: Best cashier and best esports book of the five, and the only one built crypto-first instead of crypto-bolted-on. It just cannot take Americans.
More info Less info
- Online since
- 2017
- Licence
- Curaçao Gaming Authority
- Min deposit
- $1
- Min withdrawal
- $10
- Payout time
- 5–30 minutes
- KYC
- Required
- Games
- 4,000+
Restricted countries: United States, United Kingdom, Netherlands, Curaçao, Aruba, Sint Maarten, Caribbean Netherlands, Spain and 13 more.
20% Cashback up to 10,000 USDT
- 17 coins, the widest cashier of the US-facing books
- $10 crypto minimum against $50 for cards
- Welcome free bet carries no rollover
Why we chose it: Widest coin support of anything that still takes Americans, with poker and esports on the same balance. The complaint record is why it is not higher.
More info Less info
- Online since
- 2004
- Licence
- Panama
- Min deposit
- $10
- Payout time
- Within 24 hours (crypto)
- Wagering
- None on the free bet, 10x on the crypto boost
- KYC
- Required
Restricted countries: Australia, United Kingdom, France, Netherlands, Malta, Slovenia, Panama, North Korea and 19 more.
Daniel Okoro
Daniel tracks crypto regulation and policy across the US, EU and Asia, with a decade in financial journalism.
