Coldcard Exploit Losses Reach $100M–$150M as Recovery Outlook Unclear

Scale of the Breach

Bitcoin stolen through the Coldcard exploit has accumulated to at least $100 million in losses, with Galaxy Research estimating the total could exceed $150 million according to reporting from Decrypt. CryptoPotato reports confirmed losses at over $100 million as of its reporting window. The discrepancy reflects ongoing uncertainty about the total volume of affected wallets and the timing of thefts across different cohorts of users.

Slowing Attack Rate and User Migration

The pace of new thefts has declined in recent weeks, suggesting the pool of vulnerable users may be shrinking. Galaxy Research attributes the slowdown to two possibilities: remaining vulnerable Coldcard holders have either migrated their funds to secure wallets or were already emptied during earlier waves of exploitation. This pattern indicates the attack is not spreading to new victims but rather completing theft cycles against existing targets.

Dispute Over Bitcoin Traceability

Experts diverge sharply on whether the stolen Bitcoin can be recovered or spent. Some security analysts contend the funds are difficult to liquidate and likely trapped on the blockchain, making them low-value to attackers. Others point to established off-ramp channels—including cryptocurrency mixers, the Lightning Network, and privacy-focused tools—that could enable attackers to obscure transaction history and eventually convert or move the stolen coins without detection. The disagreement reflects genuine uncertainty about the practical liquidity of large stolen UTXO sets in the current regulatory and technical environment.