### The Coldcard Security Crisis: A Growing Threat to Bitcoin Self-Custody
The landscape of Bitcoin security has been shaken by a persistent and sophisticated exploit targeting Coldcard hardware wallets. What began as a localized concern has evolved into a systematic campaign, with recent data from Galaxy Research indicating that approximately $88.6 million in Bitcoin has been siphoned from 4,585 unique addresses.
#### Escalating Losses and Systematic Sweeps
The situation remains critical as the attackers continue their operations. Galaxy Research recently confirmed a third wave of unauthorized activity, resulting in the loss of an additional 207.73 BTC. This brings the total volume of stolen assets to roughly 1,367 BTC.
Alex Thorn, the head of research at Galaxy, has characterized these thefts as highly calculated. Rather than random acts of cybercrime, the precision of these sweeps suggests the use of Large Language Models (LLMs) or similar automated orchestration to identify and drain vulnerable wallets. Thorn’s analysis offers a grim outlook: any single-signature Coldcard address established following the firmware vulnerability discovered in March 2021 is effectively a ticking time bomb. The consensus among security experts is that, without intervention, these wallets will eventually be emptied by the attackers.
#### A Shift in Custody Strategy
The scale of this breach has triggered a paradoxical reaction within the crypto community. For years, the mantra “not your keys, not your coins” has served as the bedrock of Bitcoin philosophy, encouraging users to move assets off centralized platforms. However, the Coldcard exploit has forced a temporary reversal of this trend. Fearing the vulnerability of their hardware devices, many users are opting to move their Bitcoin back to reputable exchanges, prioritizing the immediate security of institutional-grade cold storage over the risks associated with compromised hardware.
#### Collaborative Defense and Investigation
In response to the ongoing theft, a collaborative effort is underway to track the perpetrators. Galaxy Research has successfully mapped on-chain patterns by leveraging transaction data provided by victims. This intelligence has allowed the firm to flag approximately 600 addresses linked to the attackers, which have since been shared with federal law enforcement, regulatory compliance firms, and private cybersecurity investigators.
“I continue to investigate and add new Coldcard victim and attacker addresses to our investigation database,” Galaxy’s head of research Alex Thorn posted to X.
For those currently holding single-signature funds on a Coldcard device, the message from researchers is clear: do not wait. The automated nature of these attacks means that the window for securing your assets is closing. Moving funds to a new, secure wallet architecture is the only way to mitigate the risk of becoming the next victim in this ongoing campaign.
