Coldcard wallet drain reaches $88 million, per Decrypt — with the mechanism still unspecified

Losses tied to an exploit affecting Coldcard bitcoin hardware wallets have reached roughly $88 million, and attackers are still emptying wallets, Decrypt reported on August 2, 2026, in a piece published at 17:18 UTC. That is the load-bearing fact, and at this hour it is close to the only one that can be nailed down.

Decrypt characterises the $88 million as a figure that has "ballooned" — meaning it is a running tally that was lower earlier and may be higher by the time you read this, not a closed forensic accounting. The report does not specify whose on-chain analysis produced the number, whether it is denominated at the price when coins moved or at current market value, or how many individual wallets are involved.

For scale: at the $63,239 bitcoin price shown on Decrypt's own ticker alongside the report, $88 million is about 1,390 BTC. Treat that as arithmetic, not as a confirmed coin count — the conversion basis for the dollar figure hasn't been stated.

Coldcard is a bitcoin-only hardware wallet line built by Canadian firm Coinkite, sold specifically to people who want keys held offline rather than at an exchange. What has not been established: the attack vector — a firmware flaw, a malicious update, a supply-chain compromise, and a phishing campaign against Coldcard owners would all fit the word "exploit" — which device models or firmware versions are affected, whether any statement or patch has come from Coinkite, and whether an independent security firm has attributed or reproduced the attack. None of that is settled here, and guessing at it would be worse than saying so.

Key facts

• $88 million in losses attributed to a Coldcard bitcoin wallet exploit, with draining described as ongoing — Decrypt, August 2, 2026, 17:18 UTC.
• Figure is a running total, not final; Decrypt frames it as having grown from an earlier, smaller number.
• ~1,390 BTC equivalent at the $63,239.00 BTC price on Decrypt's ticker at the time of the report — Cleartext's own conversion, and dependent on a valuation basis that hasn't been disclosed.
• Not established: attack vector, affected models or firmware, victim count, source of the on-chain estimate, vendor response.

The real-world read

One report, one number, no primary source behind it. Decrypt is reputable, but a nine-figure loss total normally traces to a named blockchain-forensics outfit or a vendor advisory, and no such attribution appears here — until it does, $88 million is an estimate of unknown provenance, and the honest read is a wide error bar.

Note also what the word "exploit" is quietly doing. It implies a defect in the device. If the actual vector turns out to be users installing a spoofed update or entering a seed phrase into a fake tool, the security story is very different from a hardware break — and the framing will have run well ahead of the evidence. The absence of any vendor comment is itself the conspicuous gap: on a live, still-growing drain, silence from the manufacturer is information.

No marketing or sponsored material fed this item, and none of it is a substitute for an advisory. If you hold a Coldcard, the operative fact is that a live drain is reported and its cause is not yet public.

Opinion, and whose

None available to attribute. No analyst, security researcher, or company representative is quoted on the record here — no forecast of final losses, no assessment of severity, no attribution of blame. Anything you see circulating today claiming to know the mechanism should be checked against a named source before you act on it.

Sources

• Decrypt — "Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets," August 2, 2026, 17:18 UTC. Provided the $88 million loss figure, the ongoing-drain framing, and the BTC price of $63,239.00 used for the conversion above. Secondary reporting; the underlying on-chain source for the figure is not identified in the report. Not sponsored, not marketing.
• No Tier 1 primary source — no Coinkite advisory, forensics report, or on-chain dataset — was available for this item. Its absence is why the mechanism is described as unknown rather than characterised.

Not financial advice. Cleartext takes no payment for coverage.