Third Wave of Coldcard Wallet Hacks Drains $89M in BTC

Third wave escalates Coldcard hardware wallet breach

A new wave of attacks targeting Coldcard hardware wallets has intensified, raising alarm across the crypto community. According to Galaxy Research, attackers in this third wave drained 208 BTC from 1,912 addresses. The cumulative theft now totals 1,367 BTC — roughly $89 million — taken from 4,585 wallets. The underlying cause traces back to a firmware vulnerability first introduced in 2021.

Details of the theft and scope

The campaign targets older, vulnerable Coldcard devices that have not been patched. Unlike earlier waves, the threat actors now move each victim's holdings to separate addresses and layer transactions through more complex structures. These changes make on-chain tracing and attribution far more difficult, complicating efforts by exchanges and investigators to follow stolen funds.

New tactics hinder blockchain tracing

By splitting funds into isolated outputs and leveraging obfuscation techniques, attackers reduce the effectiveness of conventional clustering heuristics and blacklist approaches. This shift underscores the rising sophistication in Bitcoin theft and the challenges it poses for crypto security teams monitoring wallet compromise.

Recommended actions for users

Coldcard users should immediately verify their device firmware version, follow official vendor advisories, and migrate assets stored on potentially vulnerable devices to wallets with freshly generated keys. Regularly updating firmware, enabling device best practices, and monitoring addresses for suspicious activity remain essential defenses.

All original images, placements, and captions from the source remain unchanged. This report aims to inform holders, exchanges, and security teams about the evolving threat landscape affecting hardware wallets.