What happened

CoinDesk reports that the Coldcard cold-wallet attack has widened, reaching roughly 4,500 addresses and losses nearing $89M. That updates a roughly $70M estimate attributed earlier in the week to Galaxy Research.

The record also says researchers warn that the attack remains active. CryptoQuant flagged 39,600 BTC moved in small transactions, calling it the largest sub-1 BTC exodus since FTX. The supplied evidence does not establish whether those transfers are directly caused by the reported attack.

Why it matters

The update places the focus on self-custody hardware at a time when reported losses are increasing and the situation is not described as contained. CZ urged wallet diversification, while cautioning that “nothing is 100%.”

For users tracking the incident, the next useful receipt is specific firmware guidance from the relevant hardware-wallet provider, along with clear evidence about containment or continued activity. Until then, the record supports monitoring reported guidance and developments, not assumptions about the attack’s scope or resolution.

What to watch

Watch for provider firmware guidance and a substantiated update on whether the reported activity has been contained.

Sources and limits

Upstream references and independent checks

Digest dated 2026-08-02 · upstream model claude-sonnet-4-6. Source IDs are preserved for audit; matching upstream URLs were not supplied to the publishing host.

  1. 1
    f6398069d1b6fc2ac49740af41944935d0211fa9Upstream reference; direct URL unavailable.
  2. 2
    d7ea4d87601d7b1f3a6ae2effb81cf31fed91e31Upstream reference; direct URL unavailable.
  3. 3
    e72a377e63b1f7ce741e25baac2717791ea6a770Upstream reference; direct URL unavailable.
  4. 4
    f8ea2659f530b2f55674e8f2e3432c46236c1598Upstream reference; direct URL unavailable.
  5. 5
    ddf1f8478e6b569c3a6bf2630f275517d2837ed9Upstream reference; direct URL unavailable.
Continue reading
  1. 1

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The supplied record reports loss estimates, address counts, transfer activity, and warnings, but it does not provide the exploit mechanism, a source-URL map, or evidence directly linking the 39,600 BTC transfers to the attack.