This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning.
Starting July 30, attackers have drained wallets hosted on Coldcard devices across multiple escalating waves: roughly 1,082 BTC by Aug. 1, then approximately 284 BTC in the next two waves, with a fourth wave possibly underway. Galaxy
Research now estimates at least 15 separate attackers are exploiting the bug independently, up from the handful of coordinated operators we initially identified, with total losses tracked near $130 million as of Aug. 4.
The vulnerability originated in Coldcard’s seed-generation process. Normally, the device would draw entropy (a measure of randomness) for a new seed phrase from a dedicated hardware random-number generator embedded in its chip. A firmware bug introduced in a March 2021 (yes, five years ago) release instead routed part of that process through a software fallback. That fallback was seeded only by the device’s fixed information and its timer/clock registers, rather than a strong source of new randomness.
As a result, affected seeds that should have contained approximately 128 bits of randomness may have had an effective entropy of only around 40 bits for affected Mk2 and Mk3 devices and 72 bits for newer Mk4, Q, and Mk5 devices. At that level, an attacker with an approximate understanding of the device identifier and seed-generation timing could generate candidate seeds offline and compare the corresponding addresses against the public blockchain. Physical access to the wallet was not required.
Coinkite, the Canadian manufacturer of Coldcard, released emergency firmware updates, but the remediation is prospective rather than retroactive. The patches can protect seeds generated after installation, but they cannot strengthen a seed that was already created using vulnerable firmware. Those seeds remain permanently susceptible to brute-force recovery. Affected users have therefore been advised to generate an entirely new seed on patched hardware and migrate their assets to new wallets.
Our take
Self-custody is often presented as the cleanest way to eliminate counterparty risk: investors hold their own private keys and are therefore insulated from the failure of an exchange, custodian, or other intermediary. The Coldcard exploit exposes the other side of that trade-off. Removing a third-party custodian does not remove custody risk; it transfers that risk to the hardware, software, and key-generation processes on which the holder depends.
The incident complicates one of the central assumptions behind self-custody. The maxim of “not your keys, not your coins” frames control of the private key as the primary safeguard against theft or confiscation. In this case, however, the hardware wallet itself introduced the vulnerability at the point of key creation. One user said he kept a Coldcard in a bank safe-deposit box, never connected it to the internet, and nevertheless lost 18.25 BTC in seven minutes. As this victim mused, “Perhaps the hardest part about this is that I did everything right.” The failure occurred before standard operational-security practices could offer any protection.
Institutional-grade custodians, such as Coinbase Custody and Fidelity Digital Assets, typically employ controls including offline key generation, multisignature authorization, geographically distributed key material, and segregated cold-storage accounts. These measures do not eliminate custody risk, but they are designed to prevent the failure of a single device or location from resulting in a total loss. In effect, they apply the same risk-distribution principle as multisignature self-custody, but embed it in a regulated and operationally controlled custodial framework.
The more durable lesson is narrower but still significant: possession of a private key is only as secure as the process and infrastructure used to create it.
Galaxy's head of firmwide research, Alex Thorn, has been tracking the onchain movement of coins stolen in the Coldcard hardware wallet exploit and working with Bitcoin community members to gather intel that might help authorities catch the thieves and recover victims' BTC. If your Coldcard device was hacked, DM @intangiblecoins on X. More than 200 victims have reached out, but Alex's AI agent is triaging messages, and he will eventually reply to all.
This document, and the information contained herein, has been provided to you by Galaxy Digital Holdings LP and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the assets mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions. The economic interests of Galaxy Digital may conflict with the views expressed in this document. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. Galaxy and the author hold a financial interest in Bitcoin (BTC). Galaxy regularly engages in buying and selling BTC, including hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy also provides services to vehicles that invest in BTC. If the value of such assets increases, those vehicles may benefit, and Galaxy’s service fees may increase accordingly. The valuation in this communication is based on technical, fundamental, and market analysis and not on any formal valuation method. For more information, please refer to Galaxy’s public filings and statements. Cryptocurrencies, including BTC, are inherently volatile and risky and ultimate market movements may not align with this statement. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here. For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including its Quarterly Report on Form 10-Q, available at www.sec.gov. Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Certain information contained herein constitutes forward-looking statements, which can be identified by the use of terms such as “may”, “will”, “should”, “expect”, “anticipate”, “project”, “estimate”, “intend”, “continue” or “believe” (or the negatives thereof) or other variations thereof. Due to various risks and uncertainties, including those discussed above, actual events or results may differ materially from those reflected or contemplated in such forward-looking statements. As a result, you should not rely on such forward-looking statements in making any investment decisions. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Galaxy Digital Holdings LP. 2026. All rights reserved.