Coldcard's $70M oopsie: Galaxy says 1,196 addresses watched a firmware bug empty their pockets overnight

Galaxy Research has revised the estimated damage from a Coldcard wallet security incident to roughly $70.2 million, more than the $38 million figure reported in earlier preliminary analysis. The research arm of Galaxy Digital identified 1,196 addresses linked to the incident and traced the movement of 1,082.65 $BTC across blocks 960,183 to 960,191 between 1:10 AM and 1:51 AM UTC on July 30, according to an X post on Friday. The activity occurred about 30 hours before Coldcard published its first security advisory.

The earlier estimate came from Rob Hamilton, CEO and co-founder of AnchorWatch, who calculated that 594.48 $BTC, worth about $38 million, had moved across 500 transactions within a three-block window. Galaxy Research said the transactions it identified shared a recognizable pattern, including identical 30 satoshis per virtual byte fees and the absence of change outputs, which allowed the initial attack activity to be traced on-chain. The firm cautioned that future attacks against Coldcard-generated addresses may not follow the same fingerprint.

Coinkite co-founder Rodolfo Novak said in an X post on Friday that the company takes responsibility for the firmware bug and is working to determine the full scope of the issue. Novak said Coinkite released a hotfix to remove the software fallback path, but warned that the update does not protect seeds generated on vulnerable firmware. He advised users who generated seeds on vulnerable firmware to move their funds to a new seed.

The Coldcard incident follows a separate security event involving SecondFi, which is winding down after a $2.6 million ADA theft linked to a wallet flaw.