Galaxy Confirms 1,719 Bitcoin Stolen Through Coldcard Seed Flaw, With Total Losses Estimated Above $130 Million

Galaxy Research has now tied 1,719 bitcoin, roughly $111 million, to the Coldcard hardware wallet exploit with what it describes as high confidence, and expects the final figure to exceed $130 million as more addresses are traced. Bitcoin Magazine, surveying affected users, reports a median loss of about 1 BTC, which means the damage is spread across a large number of ordinary self-custody holders rather than concentrated in a few large balances.

The root cause is not a smart-contract bug or a stolen key. It is entropy. A firmware release pushed on March 17, 2021 degraded the device's random-number generation for on-device seed creation, producing roughly 72 bits of effective randomness on newer models instead of the intended 128, with older units weaker still, according to reporting on Galaxy's analysis. That gap is the entire attack. It moved seed recovery from computationally impossible to a search an adversary can run offline, with no physical access to the device and no interaction with the victim. Attackers precomputed candidate seeds and swept balances in coordinated waves beginning July 30. TRM Labs calls it the largest hardware wallet exploit of 2026.

Community advisories on Bitcointalk are telling affected owners to treat funds on any device seeded after that firmware date as at risk and to migrate to a seed generated with external entropy such as dice. There is no recovery mechanism. Bitcoin has no issuer that can freeze balances, which is the property that makes it censorship resistant and also the property that makes this loss final. Nothing has been recovered, and no attribution to a named actor has been published.

The market response has moved only one way. Bitcoin exchange-traded funds (ETFs) added close to $800 million in the days after the exploit surfaced. A defect in the tool that exists to remove counterparty risk is pushing capital toward products that reintroduce it.