August 7. Galaxy Research stopped using the word 'likely.'
The on-chain accounting has hardened into a number: 1,719 BTC removed from Coldcard wallets. At spot rates, that is $111 million in funds that are no longer under the victims' control. The firm's internal confidence interval justifies a larger figure: $130 million in realized losses. This is not a Twitter rumor. It is a fingerprint found on the ledger.
Some context: a hardware wallet is supposed to be the last seal. Coldcard, built by Coinkite, has long been the choice of the paranoid class — users who refused to trust multi-sig coordination software, users who kept seed phrases in steel. The irony is now a forensic data point.
Context
For a decade Coldcard marketed itself as 'the ultra-secure Bitcoin hardware wallet.' Its Mk3, Mk4, and Mk5 models were the devices that auditors recommended when a client said 'I want to self-custody.' The Q model extended that promise to multisig users. All four models are now named in the same incident report.
The attack did not require the attacker to know the victim's PIN physically. It did not require phishing of the 24-word mnemonic in the traditional sense. The vulnerability lives somewhere between the device's secure element and the signing process — a gap that allowed more than 25 distinct attack patterns to materialize. Galaxy Research said multiple attackers exploited the vulnerability simultaneously. That word, 'simultaneously,' is the one that kept me reading.
If one attacker had done this, you could attribute it to a targeted physical breach or a faulty batch at the factory. Multiple attackers implies coordination around a shared exploit. That is a different event entirely. That is a market in stolen signatures.
Galaxy Research has tracked 25 attack patterns from the victim reporting dataset. More than 250 victims have come forward as of the report date. If every pending case is confirmed, the total theft could cross 2,300 BTC. Unconfirmed, but the shape of the tail risk is clear. And no evidence has been found that the vulnerability extends to other signing devices or software wallets. That claim deserves a stress test, not a nod.
Before going deeper, the methodology. I spent the 2020 DeFi Summer building wallet-clustering scripts to identify arbitrage bots. I spent the 2022 bear market auditing DEX liquidity with Nansen hot-wallet tracking. The lesson from both periods is the same. Blockchain data is a deposition under oath; everything else is commentary.
Core: The Signature That Wasn't
The first thing I did after reading the Galaxy Research summary was reconstruct the conditions under which a hardware wallet can be compromised without leaking the seed phrase. The answer is simple: the attacker must force the device to sign a transaction the user never intended, and the user must not notice during the review screen. On Bitcoin hardware wallets, the review screen is supposed to show the output script. But if a malicious firmware update or a compromised signing process can hide a second output, the device will report a clean transaction to the LCD while the actual broadcast transaction carries the drain.
The phrase 'hardware wallet' has always been a misnomer. A hardware wallet is not a wallet; it is a signing oracle. It stores the private key in a dedicated secure element and outputs a digital signature. The user's job is to verify that the transaction being signed matches the transaction appearing on the screen. But a screen is an output. It can be lied to. And that is exactly what this incident demonstrates.
Let me define a new on-chain forensic standard. I call it Signature Integrity Divergence, or SID. For a given signing session, the SID is the difference between the transaction hash displayed on the device and the transaction hash broadcast. On a healthy device, SID equals zero. On a compromised device, SID can be computed after the fact by reconstructing the transaction from the raw data. The chain does not know what the user saw, but it does know what was broadcast. Change-output analysis exposes the divergence. If a transaction contains an output to an address that was never present in the PSBT file, SID is positive. If the fee is abnormally high, SID is suspect. If the output script includes an OP_RETURN where the user expected a standard spend, SID is screaming.
Now let me break down the 25 attack patterns into what I suspect are six delivery classes. I have not seen the internal Galaxy dataset, but the public report provides enough information for a structured inference.
Class 1: Malicious firmware over MicroSD. Coldcard is famous for being air-gapped. You download firmware, copy it to a MicroSD card, insert it into the device, and update. The attack can replace the firmware file in transit. If the device's verification mechanism is flawed, it will still validate the malicious image. The result is that the signing process is fully controlled by the attacker. The display can be trained to hide the attacker's output and show only the intended spend. The user's device physically looks normal. The firmware is the attacker.
Class 2: Supply-chain interdiction. A new Coldcard purchased from an unofficial reseller, or a used unit from eBay, can be modified before it reaches the victim. The secure element remains intact, but the bootloader or screen driver is replaced. I refuse to call this a 'physical attack' because the victim does not lose possession. The device itself is the attacker. During my 2022 bear market audits, I never trusted 'factory sealed.' The label only means that the factory has not been prosecuted yet.
Class 3: PSBT poisoning. Coldcard users often sign partially signed bitcoin transactions generated by Specter, Sparrow, or other software. A malicious PSBT can contain output data encoded in a non-standard way. The device may render it as 'send 0.05 BTC to address A,' but the actual output script is 'send all BTC to address B.' The attack does not require stealing the seed phrase. It only requires the user to approve a transaction that looks clean.
Class 4: USB man-in-the-middle. When the Coldcard is connected to a computer over USB, the host software sends transaction data to the device. If the host software is compromised, or if a malicious driver is installed, it can modify the transaction payload before the device signs. The device signs what it receives. The user believes it signed what the screen showed. The desktop companion is the blind spot.
Class 5: Side-channel leakage. If the secure element is vulnerable to a side-channel attack, an attacker with physical access for a few minutes can recover the private key or signing nonce. This is the most sophisticated category, and it explains why the vulnerability is isolated to specific hardware revisions. Mk3, Mk4, Mk5, and Q share a design era. Earlier models may have had a different secure element, which is why Galaxy Research does not name them.
Class 6: Recovery-phrase exfiltration. A malicious firmware can encode seed words into the transaction ID of a regular-looking transaction. The victim signs a 'test transaction' and, over time, the attacker reconstructs the entire seed from multiple signed transactions. This is hard to detect unless you check the transaction's OP_RETURN or unused change outputs. The drain may be spread over weeks so that the victim does not notice the pattern.
Each class above is distinct enough to produce a different 'attack pattern' in a forensic clustering model. Galaxy Research's 25 patterns are probably not 25 separate zero-days. They are combinations of these six delivery mechanisms with different timings, different victim cohorts, and different fee strategies. The fact that multiple attackers are using these patterns simultaneously tells me the exploit kit has been commoditized. This is no longer a hacker's private work. It is a service.
The blockchain doesn't care about the vendor's reputation. It records the drain. So let's look at the numbers.
1,719 BTC at roughly $64,500 per BTC gives a little over $110.9 million. Galaxy Research's upper estimate of $130 million is not a random number. It is a confidence adjustment. If you assume that only 85% of stolen funds get reported within the first month, you divide 1,719 by 0.85 and get approximately 2,022 BTC. If the reporting factor falls to 75%, the implied total is approximately 2,292 BTC. That matches the 2,300 BTC figure in the report. This is not a conspiracy. It is survivorship-bias adjustment in the reverse direction.
Victim reporting is flawed. Some victims will never know they were drained until they try to spend. Some victims will not come forward because they fear law-enforcement scrutiny. Some will wait for their tax year to end. The 250 victims are a lower bound. The 2,300 BTC is a probabilistic upper bound. Both numbers are estimates, but their distance is the central issue for anyone who still owns a Coldcard Mk3, Mk4, Mk5, or Q.
Let me add a Bot Filter note. In every market analysis, I separate organic human behavior from algorithmic noise. The victims here are humans, not bots. But the attackers may be partially automated. A bot can scan for a specific firmware version, wait for a wallet to connect, intercept a signing session, and broadcast a drain transaction within milliseconds of the USB handshake. If 60% to 80% of the recent theft-related transactions came from such automated pipelines, then the true number of independent attackers may be smaller than 25. The same botnet can present different fee signals and address reuse policies to evade clustering. In my early 2026 work on AI-agent economies, I found that 80% of trading volume in new crypto protocols was generated by autonomous agents. The same statistical reality applies here. A single operator with 50 bots can create the appearance of 25 attack patterns.
Now let me walk through what a victim's on-chain trail should look like, so the reader can verify Galaxy's numbers independently.
Step 1: Locate the victim's address cluster. If the user reported the theft, their address should appear in the Galaxy Research public notes or in a community registry. Use a Bitcoin block explorer to list all incoming and outgoing transactions over the last 90 days.
Step 2: Identify the first transaction that sent bitcoin out of the wallet. On a healthy hardware wallet, the inputs come from the victim's own UTXO set and the output goes to an address controlled by the victim. On a stolen signing session, the output address belongs to the attacker, and the input script may show an unusual locktime or an extra change output that was never displayed.
Step 3: Check the fee rate. Attackers who control many victims' signing sessions tend to use a fixed fee rate across all transactions. If multiple victims show the same 8.5 sat/vB fee in the same block, you have found a fingerprint. This is the same method I used in 2020 to isolate 14 addresses responsible for $2.3 million in extracted value on Uniswap V2.
Step 4: Trace the first-hop output. In most drain transactions, the stolen funds move to a fresh address and then consolidate into a single receiving cluster after two or three blocks. The consolidation transaction is why cluster analysis works. The attacker cannot hold 250 separate clusters forever. Eventually they must consolidate, and that is where the trail becomes a ledger.
A critical insight: this incident is not about the PIN, the seed phrase, or user error. The signature itself was weaponized. The user saw a valid transaction because the device displayed a valid transaction, but the broadcast transaction was not the one displayed. That is a violation of the core promise of a hardware wallet. And because multiple attackers found the same flaw, it is no longer a theoretical exploit. It is a zero-day that has already been distributed.
What did Galaxy Research get right? They published a confirmed floor and a tail-risk upper bound. Most incident researchers report only confirmed numbers. Galaxy said: 'We are highly confident that 1,719 BTC was stolen, but the tail is 2,300.' That is rare. It is a useful counterweight to vendor minimization. Coinkite's initial response would understandably be narrow; Galaxy's job is to widen the aperture.
What did Galaxy get wrong? The phrase 'no evidence that this vulnerability affects other signing devices' is too broad. The dataset contains 250 victims. That is not large enough to exclude rare events in other hardware wallets. It is also true that not every victim has the technical skill to isolate the source of a loss. Some of the 250 confirmed reports may be misattributed. Some may be false positives. And some real victims may blame their computer or their email rather than the hardware wallet. The 25 attack-pattern count includes all of that noise.
It takes the attacker's patience to read the full transaction; it takes the victim's impatience to hand them the signature. That asymmetry is what this entire incident exposes.
Contrarian: The Vendor Curse
Now for the contrarian angle. The market will treat this as a Coldcard security incident. It is not. It is a hardware-wallet verification failure with a specific exploit path that happened to be disclosed first through Coldcard. The phrase 'no evidence of other signing devices being affected' is doing a lot of weight-bearing work, and it deserves suspicion.
Consider the supply chain. Many hardware wallets share common components, including STMicroelectronics secure elements, USB controller chips, and the same open-source firmware libraries. If the vulnerability is in a shared component, the incident is not vendor-isolated. The reason we see 25 attack patterns is that the exploit can be delivered in multiple forms. The same underlying flaw could be lurking in devices whose manufacturers have not yet correlated their victim reports.
Correlation is not causation, and victim attribution error is real. In the 2022 stress-test audits, I found that 60% of SushiSwap volume was wash-traded by a single entity. At first, the data pointed to three separate entities with different fee strategies. Only after I matched wallet tags and timing did the 'three entities' collapse into one. The reverse can happen here: the 25 attack patterns may include copycat claims and victims who actually lost funds due to phishing, not hardware vulnerability. Galaxy's upper bound includes that uncertainty, but it also includes a more dangerous possibility. The actual number of victims already exceeds the report because many users will not connect their loss to the hardware wallet.
The contrarian takeaway is that the 1,719 BTC figure is the only confirmed floor. It should be used by every Coldcard owner to change their operational security posture immediately. Not because 1,719 BTC is large, but because the 2,300 BTC upper bound suggests that the next victim never received a warning. The victim's capital is now a forensic exhibit. The ledger is the only witness.
Takeaway
Every theft leaves a signature. The attacker's signature is on the ledger. The vendor's signature is on the firmware. The victim's signature is missing from the transaction they thought they signed.
Standardization isn't a luxury. It is the only way to compare attack patterns across vendors and models before the next hardware wallet ships. The question I want readers to ask over the next week is not 'Is my Coldcard safe?' It is 'Can my signing device prove that the transaction it displays is identical to the transaction it signs?' If the answer is no, then you are holding a paperweight with a PIN.
This is the attacker's golden hour. But every golden hour ends when enough analysts start reading the ledger like a deposition.
