Coldcard Bitcoin losses rise to $88.6M in third wave

Galaxy Research raised its estimate of Bitcoin drained from addresses linked to the Coldcard firmware flaw to 1,367.05 BTC, worth about $88.6 million, on Aug. 1. Summary 1,367.05 BTC was drained across 4,585 addresses in three suspected Coldcard attack waves, Galaxy reported. July 30’s first wave removed 1,082.65 BTC from 1,196 addresses in just 41 minutes total. Firmware updates fix new seed generation but cannot repair vulnerable seeds created on earlier releases. The research unit identified 4,585 affected addresses across three suspected attack waves, replacing its earlier estimate of 1,082.65 BTC from 1,196 addresses. The revised figure means the $70.2 million estimate reported after Galaxy’s first analysis is no longer current. Galaxy described the total as its “estimated observed size,” leaving open the possibility that further transactions could be found. The company has not proved that every address came from a vulnerable Coldcard seed. We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by @clay_garrett1,196 addresses drained in full for 1,082.65 BTC (~$70.2M) between 01:10:20 and 01:51:26 UTC on Jul ...