# Galaxy Confirms 1,719 Bitcoin Stolen Through Coldcard Seed Flaw, With Total Losses Estimated Above $130 Million

A firmware update shipped in March 2021 cut the randomness in device-generated seeds, letting attackers recompute private keys offline without ever touching a wallet.

- Published: 2026-08-08T05:55:47.567Z
- Canonical: https://polylog.news/crypto/2026-08-08/galaxy-confirms-1-719-bitcoin-stolen-through-coldcard-seed-f
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/coldcard-victims-report-median-loss-1btc), [Polylog editors](https://polylog.news), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5589927.0), [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitcoin-etfs-800-million-coldcard)

Galaxy Research has now tied 1,719 bitcoin, roughly $111 million, to the Coldcard hardware wallet exploit with what it describes as high confidence, and expects the final figure to [exceed $130 million](https://t.me/GokuCryptoNews/20313) as more addresses are traced. Bitcoin Magazine, surveying affected users, reports a [median loss of about 1 BTC](https://bitcoinmagazine.com/news/coldcard-victims-report-median-loss-1btc), which means the damage is spread across a large number of ordinary self-custody holders rather than concentrated in a few large balances.

The root cause is not a smart-contract bug or a stolen key. It is entropy. A firmware release pushed on March 17, 2021 degraded the device's random-number generation for on-device seed creation, producing roughly 72 bits of effective randomness on newer models instead of the intended 128, with older units weaker still, according to [reporting on Galaxy's analysis](https://cryptobriefing.com/galaxy-digital-coldcard-hack-analysis/). That gap is the entire attack. It moved seed recovery from computationally impossible to a search an adversary can run offline, with no physical access to the device and no interaction with the victim. Attackers precomputed candidate seeds and swept balances in coordinated waves beginning July 30. TRM Labs calls it the [largest hardware wallet exploit of 2026](https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack).

Community advisories on Bitcointalk are telling affected owners to [treat funds on any device seeded after that firmware date as at risk](https://bitcointalk.org/index.php?topic=5589927.0) and to migrate to a seed generated with external entropy such as dice. There is no recovery mechanism. Bitcoin has no issuer that can freeze balances, which is the property that makes it censorship resistant and also the property that makes this loss final. Nothing has been recovered, and no attribution to a named actor has been published.

The market response has moved only one way. Bitcoin exchange-traded funds (ETFs) [added close to $800 million](https://bitcoinmagazine.com/news/bitcoin-etfs-800-million-coldcard) in the days after the exploit surfaced. A defect in the tool that exists to remove counterparty risk is pushing capital toward products that reintroduce it.

## What this means

The failure sits below the layer most holders check. Users can verify a firmware signature, a receive address and a seed backup, and still hold a key an attacker can regenerate, because randomness quality is invisible from the outside. Hardware vendors are exposed through liability and through the certification claims they market, and self-custody holders are exposed with no recourse, since bitcoin has no freeze function. The immediate flow effect is substitution: risk-averse holders move to ETFs and qualified custodians, which concentrates coins with a smaller number of regulated institutions and gives those institutions more influence over the asset's market structure.

## What to watch

- Whether Galaxy's confirmed total keeps climbing past the $130 million estimate, which would show attackers are still working through precomputed seed sets.
- Whether other wallet manufacturers publish independent entropy audits of past firmware, since a second vendor with the same class of defect would turn this from one company's failure into a category failure.
- Continued net creations in spot bitcoin ETFs, the clearest measure of holders trading self-custody risk for custodial risk.