Galaxy Research reported that user losses from Coldcard wallets exceeded $115 million. Starting July 30, attackers withdrew 1,778.58 bitcoin
BTC, from 8,680 addresses. Experts cited such data for the last time.
On the new diagram, the company shows the 10 largest groups that withdrew funds, broken down by their activity. However, most of the addresses from which the money left are not yet linked to specific owners. Telegram
All stolen bitcoins were created after the 2021 firmware.
The vulnerable firmware version was released on March 17, 2021 at block 674,951. Galaxy analysts found not a single affected coin created before this date.
Of the 6,303 seized bitcoins, none appeared before the release. The same applies to the 3,598 addresses reported by the victims: the earliest one dates to March 22, 2021.
This boundary directly indicates a vulnerability. Keys from the affected devices exist only after the firmware release, meaning the bitcoins on them appeared no earlier than this date.
The storage durations show the scale of the problem. The emptied addresses on average lasted 1,292 days—about 3.5 years. Notably, on August 3, Galaxy warned about new attacks on wallets.
Withdrawal of 61% of the funds in less than an hour
Updated statistics increased the total amount of losses for hardware wallet users. The first attack caused the most damage.
Galaxy attributes the first-wave losses of $70.2 million—61% of the total amount. The withdrawal speed concerned Binance founder Changpeng Zhao (CZ).
The funds were transferred across nine consecutive blocks, taking 41 minutes. The operator paid a fixed commission of about 30 satoshis per vByte, and for each transaction emptied one address.
In the first attack, 1,195 wallets were affected, and the withdrawn assets were split into four "collectors." For comparison: the Footprint E wave affected more addresses—2,147—and grouped up to 795 vaults in a single transaction.
Most of the digital assets from the first wave remained untouched: of the 1,082.65 BTC, 1,082.57 are still stored in place. Almost all of the Footprint E funds—209.94 BTC—have already been transferred; only 4.38 BTC remain.
Assets from the third wave were moved using a different scheme. Here, the bitcoins first went to regular wallets, but now 207.73 BTC are locked in scripts—"vaults."
Victims' reports still lag behind what is visible on the blockchain. Only 192 people out of the already published cases reported losses—their total damage was 714.81 BTC, or 40.2% of all stolen bitcoins.
Some losses reach up to 58.97 BTC; the median is about 1.03 BTC. Another 6,890 addresses with 1,063.76 BTC have not been linked to any owner yet.