Bitcoin Cold-Wallet Attack Reaches 4,500 Addresses with $89M in Losses as Third Sweep Wave Hits

The Quick Take

• A sophisticated Bitcoin cold-wallet attack has spread to 4,500 addresses with total losses approaching $89 million
• Galaxy Research identified this as a third wave targeting weak private keys generated by compromised Coldcard hardware wallet firmware
• Attackers are now targeting smaller wallet balances and shifting tactics to drain remaining vulnerable addresses more efficiently

A cascading Bitcoin security exploit targeting Coldcard hardware wallet users has reached a third wave of address sweeps, according to research from Galaxy Digital. The attack vector exploits cryptographically weak private keys generated by specific Coldcard firmware versions, allowing the attacker to reconstruct private keys and drain Bitcoin holdings without user interaction or social engineering. Hardware wallets have historically been considered the gold standard for Bitcoin self-custody security, and a multi-wave exploit of this scale challenges assumptions about cold storage safety that underpin the self-custody ethos of the Bitcoin community.

The attack creates cascading risk across the Bitcoin self-custody ecosystem — users holding BTC in any Coldcard device face uncertainty about their key integrity even if their specific firmware version has not yet been confirmed as vulnerable. Galaxy Research's public disclosure accelerates both attacker and defender activity: remaining vulnerable wallets race to move funds while the attacker shifts to targeting smaller balances that were previously uneconomical to sweep. Custodial exchanges including Coinbase and Kraken may see elevated inflows from self-custody users migrating to institutional custody as confidence in hardware wallet security temporarily erodes across the market.

The immediate forward signal is Coldcard maker Coinkite's public response and firmware audit findings — if specific Coldcard firmware versions are definitively identified as the vulnerability source, the attack surface becomes bounded and self-custody users can assess their exposure precisely. The macro variable is regulatory response: repeated large-scale Bitcoin losses drive congressional and SEC attention toward mandatory disclosure requirements for hardware wallet security vulnerabilities. An SEC or Treasury rulemaking on crypto custody standards, already under active discussion in 2026, could accelerate materially if the $89 million loss total continues to grow across additional sweep waves.

Synthesized from 1 source.