Galaxy Research: It is estimated that the total loss from the Coldcard vulnerability may exceed 130 million dollars, with over 250 victims reporting

According to a post by Galaxy Research, as of now, approximately 1719 BTC have been confirmed stolen in the Coldcard hardware wallet vulnerability attack, valued at around 111 million USD. Several other transactions are still under verification, and the total loss is expected to exceed 130 million USD. If the unverified portion is ultimately confirmed, the scale of theft could reach over 2300 BTC. In addition, collaborating researchers have received reports from more than 250 victims. Based on the loss situation from the first three waves, most victims are ordinary Bitcoin holders rather than whales.

Galaxy Research stated that it is currently tracking over 25 independent attack patterns, including the previous first to third waves, indicating that multiple different threat actors are actively exploiting the vulnerability. All addresses corresponding to the stolen coins were created after the affected firmware was released on March 17, 2021. There is currently no evidence that the vulnerability affects other signing devices or wallets outside of the Coldcard Mk3, Mk4, Mk5, and Q series firmware released after that date.