Coldcard Bitcoin Theft Losses Could Top $150 Million, Galaxy Says

Coldcard, a hardware wallet designed to keep Bitcoin private keys offline, has faced scrutiny over thefts linked in reports to a random-number-generation flaw dating to 2021. The weakness may have allowed attackers to derive keys and drain vulnerable wallets. The episode is significant because it challenges the security premise of hardware custody and highlights the persistent risk facing older devices whose funds were never migrated.

Galaxy Research said the theft campaign targeting Coldcard Bitcoin holders has recently slowed, possibly because the most vulnerable users have moved their assets or affected wallets have already been emptied. Reported losses now exceed $115 million, according to the latest account. Galaxy estimates the cumulative total could ultimately surpass $150 million, leaving a substantial gap between confirmed losses and the potential final toll.