{"id":11500,"date":"2026-08-05T08:22:09","date_gmt":"2026-08-05T08:22:09","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11500"},"modified":"2026-08-05T08:22:09","modified_gmt":"2026-08-05T08:22:09","slug":"coldcard-exploit-expands-as-attackers-steal-up-to-130m-in-bitcoin","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11500","title":{"rendered":"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_667374bd543ef3d6d4de8dababc0cfb0\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Galaxy Research raised its confirmed tally to 1,596 BTC, more than US$100 million, taken from about 7,300 addresses as of Tuesday.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A suspected fourth wave, which Galaxy holds with medium-high confidence and has not been confirmed through victim reports, would lift the total to about 2,055 BTC, or roughly US$130 million (AU$184.6 million).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Coinkite\u2019s advisory has not been updated since August 1 and still carries no loss figure, no victim count and no apology.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p class=\"wp-block-paragraph\">At least 15 separate attackers are draining Bitcoin from wallets built with defective Coldcard firmware, Galaxy Research said Tuesday, lifting its confirmed tally to 1,596 BTC, more than US$100 million (AU$142 million), from about 7,300 addresses.<\/p>\n<p class=\"wp-block-paragraph\">Two days earlier, the same tally stood at 1,367 BTC across 4,585 addresses. The coin total rose about 17% over those two days while the number of drained addresses rose about 59%.<\/p>\n<p class=\"wp-block-paragraph\">Galaxy Research head of research Alex Thorn said there are \u201cnow NUMEROUS different attackers exploiting the Coldcard vulnerability\u201d, estimating at least 15 of them working through the remaining exposed wallets.\u00a0<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"\/>\n<p class=\"wp-block-paragraph\">Galaxy had already cautioned that later waves should not be assumed to involve the same attacker.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Russia Bans Crypto Mining in Moscow Region Until 2032 Over Power Concerns<\/strong><\/p>\n<h2 id=\"h-coinkite-faces-questions-as-coldcard-exploit-grows-nbsp\" class=\"wp-block-heading\">Coinkite Faces Questions as Coldcard Exploit Grows\u00a0<\/h2>\n<p class=\"wp-block-paragraph\">Galaxy identified a further suspected sweep that would carry the total to about 2,055 BTC, roughly US$130 million (AU$184.6 million), across more than 7,700 addresses. It holds that wave with medium-high confidence and has not confirmed it through victim reports.<\/p>\n<p class=\"wp-block-paragraph\">Coinkite acknowledged the underlying defect on July 31 and shipped emergency firmware for every affected model. Seeds generated on Mk2 and Mk3 devices without dice rolls carried roughly 40 bits of entropy, and those on the Mk4, Mk5 and Q about 72 bits, against the 128 the devices were meant to produce.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Galaxy traced the fault to a silent March 2021 change to the random number generator. Installing the update does not repair a seed already created.<\/p>\n<p class=\"wp-block-paragraph\">Coinkite\u2019s advisory has not changed since August 1 and names no loss figure, no victim count and no number of attackers. \u201cOur investigation is ongoing, and a formal technical review will be released as soon as possible,\u201d it says. That review has not appeared.<\/p>\n<p class=\"wp-block-paragraph\">Dragonfly managing partner Haseeb Qureshi argued that about US$2 (AU$2.84) of what he called AI hardening could have caught the flaw, citing a test in which the model GLM 5.2 ran for 20 minutes at roughly that cost.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Qureshi proposed a \u201cCost of Discovery\u201d measure for how cheaply a frontier model can reproduce a vulnerability, and said there is no evidence the thieves used AI.<\/p>\n<p class=\"wp-block-paragraph\"><strong>Read more: Telegram Under Fire: Australia Sues as Russia Targets Founder Pavel Durov<\/strong><\/p>\n<\/p><\/div>\n<p>Bitcoin,Hackers#Coldcard #Exploit #Expands #Attackers #Steal #130M #Bitcoin1785918129<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Galaxy Research raised its confirmed tally to 1,596 BTC, more than US$100 million, taken from about 7,300 addresses as of Tuesday. A suspected fourth wave, which Galaxy holds with medium-high confidence and has not been confirmed through victim reports, would lift the total to about 2,055 BTC, or roughly US$130 million (AU$184.6 million). Coinkite\u2019s advisory<\/p>\n","protected":false},"author":1,"featured_media":11501,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[6032,5057,91,5845,942,664,831],"class_list":["post-11500","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-130m","tag-attackers","tag-bitcoin","tag-coldcard","tag-expands","tag-exploit","tag-steal"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11500\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin\" \/>\n<meta property=\"og:description\" content=\"Galaxy Research raised its confirmed tally to 1,596 BTC, more than US$100 million, taken from about 7,300 addresses as of Tuesday. A suspected fourth wave, which Galaxy holds with medium-high confidence and has not been confirmed through victim reports, would lift the total to about 2,055 BTC, or roughly US$130 million (AU$184.6 million). Coinkite\u2019s advisory\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11500\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-05T08:22:09+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11500\",\"name\":\"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg\",\"datePublished\":\"2026-08-05T08:22:09+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11500\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg\",\"width\":2048,\"height\":1536},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11500#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11500","og_locale":"en_US","og_type":"article","og_title":"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin","og_description":"Galaxy Research raised its confirmed tally to 1,596 BTC, more than US$100 million, taken from about 7,300 addresses as of Tuesday. A suspected fourth wave, which Galaxy holds with medium-high confidence and has not been confirmed through victim reports, would lift the total to about 2,055 BTC, or roughly US$130 million (AU$184.6 million). Coinkite\u2019s advisory","og_url":"https:\/\/cryptonews.uk.com\/?p=11500","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-05T08:22:09+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11500","url":"https:\/\/cryptonews.uk.com\/?p=11500","name":"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg","datePublished":"2026-08-05T08:22:09+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11500#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11500"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11500#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/90478.jpeg","width":2048,"height":1536},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11500#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Coldcard Exploit Expands as Attackers Steal Up to $130M in Bitcoin"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11500"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11500\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11501"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}