According to Galaxy Digital’s chief researcher, Alex Thorn, at least 15 different hackers have used this Coldcard vulnerability, as per the reports received after the incident. Thorn explained that the victims’ reports were useful because they enabled the firm to tag new hackers who would otherwise remain anonymous, since it was a different kind of exploit than the one carried out on a centralised exchange. It is estimated that the damage caused by this Coldcard exploit amounts to $100 million (roughly Rs. 951 crore).
Researchers Link Multiple Wallet Theft Waves to Same Security Flaw
The reported loss of 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves and 14 more smaller incidents, as per Galaxy Research. The research firm also added that, in total, 73 individual victims have reached out to Thorn for help tracing their coins. With help from victim reports, the company has identified 14 additional footprints. These could be many different attackers individually exploiting the now-known vulnerability. The attack brought back the discussion on the safety of cold wallet storage services and whether people were better off keeping their own Bitcoin.
now NUMEROUS different attackers exploiting the Coldcard vulnerability. we estimate at least 15 different attackers now
we continue to receive victim reports and give them info to report to authorities
and those reports help us identify new attacks and label attackers https://t.co/6ybBTqJPb6
— Alex Thorn (@intangiblecoins) August 4, 2026
The incident occurred last week on Friday, when 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 361 crore), were attacked and stolen. The attack was traced to a flaw in how Coldcard hardware wallets generated their keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window.
Post the first wave of thefts on Coldcard wallets, the users are now being warned of a new wave of coordinated attacks targeting Bitcoin wallets. Thorn warned that hundreds of transactions are impacting 709 potential victim addresses, moving 448.7 Bitcoin (BTC). According to Thorn, this activity takes place at an average rate of 13.8 sweeps per block, which is about 45 times the rate seen before the incident within the control period.
According to managing partner Haseeb Qureshi of Dragonfly, “about $2 of AI hardening” would have prevented the Coldcard exploit, referencing social media reports that some of the AI models re-found the vulnerability exploited to perform the hack within 20 minutes or less. The comment was made in response to several users on social media who claimed that Claude regenerated the vulnerability within just eight minutes.
