The Coldcard hardware wallet vulnerability continues to send shockwaves through the Bitcoin community, with researchers now warning that total losses could surge to approximately $130 million as a suspected fourth wave of wallet sweeps intensifies. The escalation represents a dramatic expansion of an attack that has already drained millions from thousands of Bitcoin holders. Galaxy Research, the digital asset analysis firm tracking the exploit, now estimates that total losses could reach 2,055 Bitcoin worth nearly $130 million if the fourth wave is confirmed. This figure marks a significant increase from earlier estimates of $89 million across 4,500 addresses, underscoring how rapidly the attack is expanding.
The Exploit's Expanding Footprint
According to the latest analysis, earlier waves of the attack drained 1,082 BTC worth approximately $70 million from 1,196 addresses. The exploit targets a firmware flaw in Coldcard hardware wallets manufactured by Canadian firm Coinkite, which has long been trusted as a Bitcoin-only hardware wallet provider. The progression from $70 million to $89 million and now potentially $130 million illustrates the compounding nature of the vulnerability. Each wave appears to target a new batch of addresses, suggesting that attackers are systematically working through vulnerable wallets rather than exploiting the flaw randomly. Users who may be affected are being urged to immediately move their funds to alternative storage solutions. The ongoing nature of the sweeps means that any wallet still vulnerable could be targeted in subsequent waves.
A Broader Wave of Dormant Wallets Awakening
The Coldcard exploit has coincided with a broader phenomenon that has caught the attention of on-chain analysts. A 12-year-old Bitcoin wallet dormant since 2013 moved $31 million worth of BTC on Monday, part of a wider pattern of long-inactive wallets suddenly transferring funds. While some of these movements may be legitimate holders repositioning their assets, the timing has raised questions about whether the Coldcard exploit is prompting a broader reassessment of hardware wallet security across the ecosystem. This broader security concern connects to other recent incidents. The Boltz bridge shutdown citing AI-assisted cyberattacks and the general rise of automated threats suggest that crypto security is entering a new, more dangerous phase.
Historical Context and the Path Forward
The Coldcard exploit is already one of the largest hardware wallet breaches in Bitcoin history. The earlier $89 million loss estimate was already significant, but the potential escalation to $130 million places this incident among the most damaging crypto security events of 2026. For the broader Bitcoin community, the Coldcard exploit serves as a stark reminder that hardware wallets, while generally more secure than software alternatives, are not infallible. Firmware vulnerabilities can exist in any product, and users should regularly update their devices and consider multi-signature setups for large holdings. As the investigation continues and the full scope of the fourth wave becomes clear, the industry will be watching closely to see how Coinkite responds and what measures hardware wallet manufacturers implement to prevent similar vulnerabilities in the future.
Stay ahead of the crypto market with Bitnxt — your trusted source for breaking news, analysis, and insights from the world of digital assets.
