Coldcard key flaw: third sweep takes 208 BTC, running total hits 1,367

A third wave of sweeps against bitcoin wallets whose seeds came from a March 2021 Coldcard firmware release ran from Friday midday to Saturday morning UTC, moving roughly 208 bitcoin out of 1,912 addresses, according to Galaxy Research, whose analysis CoinDesk reported Sunday. That brings observed losses across all three waves to 1,367 BTC — put at nearly $89 million — from 4,585 addresses.

The flaw itself is not an exploit of the hardware. That firmware build routed seed generation to a predictable software randomiser rather than the chip's hardware one, leaving a bounded set of possible keys that anyone with the public disclosure and enough compute can reproduce offline, never touching a device.

The waves differ sharply in size and craft. The opening wave on July 30 took 1,083 BTC from 1,196 addresses in 41 minutes — close to a full coin per victim. Wave three averages just over a tenth of a coin. Subtracting both from the running total leaves roughly 76 BTC from about 1,477 addresses for the middle wave, which wasn't broken out directly.

Wave three also collects differently: each victim's coins go to their own destination rather than the handful of shared collector addresses that made waves one and two easy to map, and land in pay-to-witness-script-hash outputs — a format that can carry multisig or timelock conditions — instead of plain single-key outputs. It batched an average of six victims per sweep where wave one took them one at a time, and scanned only the default derivation path rather than testing several branches per seed.

Galaxy said it is confident each wave is internally the work of one operator but will not link the three, because the chain does not reveal whether separate sweeps are coordinated.

Key facts

• Third wave: ~208 BTC from 1,912 addresses, Friday midday–Saturday morning UTC — Galaxy Research, via CoinDesk
• Running total: 1,367 BTC, nearly $89 million, from 4,585 addresses — Galaxy Research, via CoinDesk
• First wave, July 30: 1,083 BTC from 1,196 addresses in 41 minutes — Galaxy Research, via CoinDesk
• Root cause: March 2021 Coldcard firmware used a software randomiser for seed generation instead of the hardware RNG — CoinDesk
• Sweeping was still active nearly three days after it began — CoinDesk

The real-world read

Every figure here traces to one firm's onchain analysis. Galaxy is a credible reader of the chain, but no independent reconstruction of the totals has surfaced.

The dollar number is moving and readers will see both versions: CoinDesk's own earlier headlines from 15–18 hours before this update describe a "$70 million Coldcard exploit." That's a growing total, not a correction — but $89 million against 1,367 BTC implies a bitcoin price near $65,100, which nobody stated outright.

Conspicuously absent: any word from Coinkite, Coldcard's maker. No statement, no affected-version list, no confirmation of remediation appears in the reporting.

Note also who is offering safety advice. CoinDesk's index carries "Binance founder CZ calls for wallet diversification after $70 million Coldcard exploit" — an exchange founder's counsel after a self-custody failure, which is an interested position. The same page runs a Binance "case study" describing the exchange as crypto's leading venue and listing its product lines; that is promotional material, not reporting, and none of it informed this story.

Opinion, and whose

Galaxy Research holds that wave three is either the same operator rebuilding after being publicly enumerated or a second one grinding the same key space independently, and that the chain cannot distinguish the two — an inference, not a finding. CoinDesk's framing that the falling average haul shows the profitable end of the key space is already picked over is the outlet's read, not attributed to Galaxy. CZ's diversification call is his own.

Sources

• CoinDesk (Aug 1, 2026), "Bitcoin cold-wallet attack spreads to 4,500 addresses as losses near $89 million" — wave totals, timings, address counts, onchain tradecraft and the firmware root cause, all citing Galaxy Research.
• CoinDesk index headlines — the earlier $70 million figure and CZ's diversification remarks, both referenced but not read in full.
• "The Evolution of the Crypto CEX Landscape: A Case Study on Binance" — Binance promotional material carried on the same page. Marketing, not news; not used as a source.

Not financial advice.