Coldcard Exploit Toll Doubles to $70M as Galaxy Counts 1,200 Drained Wallets

Losses tied to a vulnerability in Coinkite’s Coldcard hardware wallet have climbed to roughly $70 million, according to updated figures from Galaxy Research — nearly double the firm’s earlier estimate. Galaxy said close to 1,200 Bitcoin addresses have now been drained of more than 1,000 BTC combined, a sharp escalation from the initial tally of 594 BTC (about $38 million) reported when the exploit first surfaced.

The revised figure underscores how quickly the scope of the incident has widened since Coinkite first flagged risk to Mk3 device users. What began as a several-million-dollar sweep has grown into one of the larger hardware-wallet losses tracked this year, with the address count suggesting the exploit affected a broad base of individual holders rather than a single large target.

CZ tells holders to split their storage

Binance founder Changpeng “CZ” Zhao responded to the growing loss estimate by urging Bitcoin holders to spread funds across multiple wallets rather than concentrating balances in a single device. “Nothing is 100%,” CZ said, framing the exploit as a reminder that even purpose-built hardware wallets carry residual risk.

CZ’s comments add weight to a message hardware-wallet security researchers have long pushed: diversification of storage — across devices, seed backups and custody methods — remains one of the few practical defenses against a single point of failure being exploited at scale.

From $38 million to $70 million

The jump in Galaxy Research’s estimate — from an initial 594 BTC/$38 million figure to more than 1,000 BTC/$70 million — shows analysts are still mapping the full blast radius of the vulnerability as more affected addresses are identified. Bitcoin was trading near $62,930 at the time of the update, meaning the dollar value of stolen coins moves with the market even as the BTC-denominated loss figure stays fixed.

Neither source detailed a fix timeline or confirmed the exact technical root cause beyond the earlier reporting that linked the losses to a seed-generation or firmware weakness in Coldcard devices, a warning that Coinkite said extended beyond the Mk3 model.

Why it matters for holders

For self-custody users, the escalating tally is a concrete data point rather than a hypothetical risk: nearly 1,200 wallets and $70 million in Bitcoin have already been lost to a single hardware vulnerability. Holders relying on a single Coldcard device — particularly older units — should treat firmware and seed-generation advisories from Coinkite as urgent, and consider CZ’s suggestion to distribute holdings across independent wallets to limit exposure to any one device or software flaw.

Read more: Coldcard Mk3 Alert: Coinkite Flags Risk After 594 BTC ($38M) Sweep

Sources

• decrypt.co
• theblock.co