Galaxy Research has raised its estimate of Bitcoin drained from addresses linked to the Coldcard firmware flaw to 1,367.05 BTC, worth about $88.6 million. The research unit identified 4,585 affected addresses across three suspected attack waves, replacing its earlier estimate of 1,082.65 BTC from 1,196 addresses. The revised figure means the $70.2 million estimate reported after Galaxy’s first analysis is no longer current. Galaxy described the total as its “estimated observed size,” leaving open the possibility that further transactions could be found.
Attack Waves
The first wave occurred between 1:10:20 a.m. and 1:51:26 a.m. UTC on July 30, draining 1,082.65 BTC from 1,196 addresses. A second wave on July 31 drained 76.16 BTC from another 1,478 addresses. Galaxy later identified a third wave that removed 207.7294 BTC from 1,912 addresses.
Cause and Response
Coinkite said a series of firmware integration errors prevented the intended hardware random-number generator from contributing properly to seed creation. The company has released hotfixes for every affected model and advised users to install the fixed firmware, generate a completely new seed, and verify its backup and receiving address.
