Galaxy Research Identifies 1,196 Addresses in Coldcard Bitcoin Loss Incident

Galaxy Research, the research arm of crypto investment company Galaxy Digital, identified 1,196 addresses linked to the Coldcard wallet incident that lost 1,082.65 Bitcoin, worth about $70.2 million at the time of the transactions.

Galaxy Research traced the Bitcoin movements between 1:10 AM and 1:51 AM UTC on July 30 across blocks 960,183 to 960,191, about 30 hours before Coldcard published its first security advisory, according to an X post on Friday.

Earlier preliminary analysis of the Coldcard incident by AnchorWatch CEO and co-founder Rob Hamilton estimated that 594.48 Bitcoin, worth around $38 million, moved across 500 transactions within a three-block window.

Galaxy Research later said the identified transactions shared a pattern, including identical 30 satoshis per virtual byte fees and no change outputs. The company said the initial attack activity is identifiable on-chain through this pattern, but noted that future attacks against Coldcard-generated addresses may not follow the same fingerprint.

Coinkite co-founder Rodolfo Novak said in an X post on Friday that the company takes responsibility for the firmware bug and is working to determine the full scope of the issue.

Novak said Coinkite released a hotfix to remove the software fallback path, but warned that the update does not protect seeds generated on vulnerable firmware. He advised users who generated seeds on vulnerable firmware to move their funds to a new seed.