Galaxy Research said losses from the Coldcard bitcoin hardware vulnerability could amount to 2,000 BTC (BTC), or around $130 million.
In a Monday post on social media platform X, Galaxy Research said it has identified 1,596 BTC stolen from 7,300 addresses across three confirmed waves of attacks, plus 14 smaller security incidents.
These attacks stemmed from an ongoing issue affecting seeds generated on Coinkite's Coldcard Mk3, Mk4, Mk5 and Coldcard Q firmware versions.
Coinkite later released emergency firmware updates for all affected models, and said it has destroyed remaining vulnerable inventory.
The issue first came to light when multiple reports of exploits emerged on July 30, in what appears to have been an automated, programmatic sweep with possible LLM assistance.
