Galaxy Research: 1,367 BTC Drained in Coldcard Hardware Wallet Attacks
Galaxy Research identified 1,367 BTC stolen across multiple attacks targeting Coldcard hardware wallet users, exposing a significant security vulnerability in the device. The breach has prompted security audits and raised questions about hardware wallet attack vectors.
Key Takeaways
- 1## The Breach and Scale Galaxy Research documented attacks on Coldcard hardware wallets resulting in the loss of 1,367 BTC across multiple incidents, according to on-chain analysis.
- 2The research firm traced the stolen funds to a series of coordinated compromises affecting Coldcard users, though the exact attack vector and timeline remain under investigation.
- 3## Implications for Hardware Wallet Security The incident highlights previously unknown vulnerabilities in Coldcard's security model or firmware.
- 4Coldcard is a self-custody device marketed to institutional and retail users as an air-gapped alternative to software wallets.
- 5The scale of losses suggests either a supply-chain compromise, a firmware flaw affecting multiple devices, or a social engineering campaign targeting Coldcard users at scale.
The Breach and Scale
Galaxy Research documented attacks on Coldcard hardware wallets resulting in the loss of 1,367 BTC across multiple incidents, according to on-chain analysis. The research firm traced the stolen funds to a series of coordinated compromises affecting Coldcard users, though the exact attack vector and timeline remain under investigation.
Implications for Hardware Wallet Security
The incident highlights previously unknown vulnerabilities in Coldcard's security model or firmware. Coldcard is a self-custody device marketed to institutional and retail users as an air-gapped alternative to software wallets. The scale of losses suggests either a supply-chain compromise, a firmware flaw affecting multiple devices, or a social engineering campaign targeting Coldcard users at scale.
Market Response
The disclosure has prompted security researchers to re-examine hardware wallet attack surfaces and manufacturers to review their firmware release processes. Users holding assets on Coldcard devices faced immediate questions about whether their devices were affected and whether migration to alternative custodial methods was warranted.
Why It Matters
For Traders
Large Coldcard-linked Bitcoin outflows may create near-term selling pressure as affected users move funds to alternative wallets or exchanges.
For Investors
Hardware wallet security breaches erode confidence in self-custody narratives and may drive institutional adoption back toward regulated custodians with insurance.
For Builders
Wallet developers and hardware manufacturers face pressure to implement additional verification layers, firmware signing schemes, and supply-chain attestation mechanisms.
