What happened

Galaxy Research estimates that confirmed losses linked to the Coldcard theft are near $100 million across three waves. The upstream record also identifies a suspected fourth sweep, which could push the total toward $130 million if confirmed.

The incident is described as an ongoing, multi-day exploit. The record also notes a spike in transfers below one Bitcoin, a pattern it says has not been seen since the FTX collapse.

Why it matters

The reported issue is framed as a hardware-RNG failure affecting the air-gap assumption for exposed Coldcard devices. That makes this more than a loss estimate: it raises a self-custody security question for users of potentially exposed devices.

The scale remains uncertain because the fourth wave is only suspected, but the confirmed-loss estimate and the amount of Bitcoin still unmoved keep the event active.

What to watch

The next useful receipt is confirmation or rejection of a fourth sweep, alongside on-chain movement of the roughly 90% of stolen Bitcoin reported as dormant. Those developments would clarify both the final loss estimate and whether the stolen funds are beginning to move.

What to watch

Watch for confirmation of the suspected fourth sweep and movement of the roughly 90% of stolen Bitcoin reported as unmoved.

Sources and limits

Upstream references and independent checks

Digest dated 2026-08-04 · upstream model claude-sonnet-4-6. Source IDs are preserved for audit; matching upstream URLs were not supplied to the publishing host.

  1. 1
    a67eac9f34e1699ef640bafa113487a0ad2f7526Upstream reference; direct URL unavailable.
  2. 2
    5e1fcc9a8f2b4816c0f11c2d9ee6793f814539faUpstream reference; direct URL unavailable.
  3. 3
    e07fecacdc064f145f46100bf2f8859765a4aaaeUpstream reference; direct URL unavailable.
  4. 4
    c32e184b77f2e496c439bd69e63bbc46e09555fcUpstream reference; direct URL unavailable.
Continue reading
  1. 1

This Research brief was generated by Terra from a dated upstream research digest. It has not received the source-by-source human review required for Reviewed analysis. Material limit: The record provides aggregate estimates and a suspected fourth wave, but does not include underlying transaction details or source URLs to independently verify them.