Coldcard has issued an urgent warning for users to migrate Bitcoin from affected wallets after confirming that an exploit targeting vulnerable firmware is still ongoing.
Galaxy Research said confirmed losses from the Coldcard wallet exploit have surpassed $100 million after identifying 1,596 stolen Bitcoin across three verified attack waves and several smaller incidents.
According to the firm, roughly 7,300 wallet addresses were affected in the confirmed attacks, while 14 additional exploit clusters have emerged through ongoing victim reports. Investigators said 73 victims contacted them to help trace stolen Bitcoin, suggesting the vulnerability is being exploited by multiple actors.
Researchers also believe a fourth large attack wave likely occurred, although it has yet to be confirmed by affected users. Including the suspected incident would increase estimated losses to approximately 2,055 BTC, valued at around $130 million.
In a statement issued this morning, Coldcard wallet maker Coinkite warned users to urgently secure their Bitcoin, saying the exploit that has drained up to $114 million from self-custodied wallets continues to target vulnerable devices.
Users of affected Coldcard models were advised to install updated firmware, create a new seed phrase and move funds to a new wallet, as compromised seeds remain vulnerable until manually replaced.
The company said wallets created using its optional dice-based entropy method are not affected by the vulnerability.
