{"id":623279,"date":"2026-08-08T10:00:15","date_gmt":"2026-08-08T14:00:15","guid":{"rendered":"https:\/\/ambcrypto.com\/?p=623279"},"modified":"2026-08-08T05:08:14","modified_gmt":"2026-08-08T09:08:14","slug":"coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns","status":"publish","type":"post","link":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/","title":{"rendered":"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns"},"content":{"rendered":"

The Colcard exploit appears to be much larger than first thought. This is because investigators have now confirmed that at least 1,719 Bitcoin [BTC], or about $111 million, has been stolen from victims of the Coldcard exploit.\u00a0\u00a0<\/span><\/p>\n

\"losses<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

In fact, according to Galaxy Research,\u00a0<\/span><\/p>\n

We have many more coins we are vetting for confirmation – we think total losses likely exceed $130m.<\/span><\/p><\/blockquote>\n

So, if the suspicious but unconfirmed cases on their current list turn out to be confirmed, the total might surpass 2,300 Bitcoin<\/a>.<\/span><\/p>\n

\"total<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

How did this attack take place in the first place?<\/span><\/h2>\n

For context, the incident involved a flaw in some Coldcard wallets using firmware released after 17th March 2021. The flaw may have affected wallet-seed security or generation.<\/p>\n

Since the seed served as a Bitcoin [BTC]<\/a> wallet’s master key, attackers who managed to recreate it were able to access the money without the Coldcard being physically compromised.<\/span><\/p>\n

\"Not<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

The firmware release date mattered because investigators found no stolen coins from wallets created before then. They identified over 25 attack patterns across three waves. This suggested multiple threat actors exploited the vulnerability.<\/p>\n

\"25<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

How widespread was the Coldcard exploit?<\/h2>\n

So far, over 250 victims have reported losses. <\/a>However, the number of affected addresses may be much higher. A single victim could have used several wallets.<\/p>\n

Galaxy Research said that not every Coldcard wallet faced exposure. However, Mk3, Mk4, Mk5, and Q models appeared vulnerable. Those models ran firmware released after 17th March 2021.<\/p>\n

For context, the Coldcard exploit started on 30th July.<\/a><\/p>\n

An attacker drained approximately 594 BTC, worth $38 million, from 500 wallets within 15 to 25 minutes.<\/p>\n

The attack created concern across the Bitcoin community. Even so, Bitcoin\u2019s core network remained unaffected.<\/p>\n

\n

Final Summary <\/span><\/h2>\n
    \n
  • Galaxy Research has discovered over 25 attack patterns in three waves.<\/span><\/em><\/li>\n
  • If the current list turns out to be confirmed, the total losses might surpass 2,300 Bitcoin.<\/span><\/em><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    With more victims being found by investigators, could Coldcard losses actually surpass $130 million?<\/p>\n","protected":false},"author":66,"featured_media":623280,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[35,66,4,20],"tags":[6427],"class_list":["post-623279","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin-news","category-new-news","category-social","category-trading-view","tag-ambcrypto"],"acf":[],"yoast_head":"\nColdcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto<\/title>\n<meta name=\"description\" content=\"Even though there are still more suspected cases, the confirmed loss currently stands at 1,719 Bitcoins worth $111 million.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-image-preview:large\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto\" \/>\n<meta property=\"og:description\" content=\"With more victims being found by investigators, could Coldcard losses actually surpass $130 million?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/\" \/>\n<meta property=\"og:site_name\" content=\"AMBCrypto\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cryptoamb\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-08T14:00:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Ishika Kumari\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/IshikaAMBcrypto\" \/>\n<meta name=\"twitter:site\" content=\"@CryptoAmb\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ishika Kumari\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"ReportageNewsArticle\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/\"},\"author\":{\"name\":\"Ishika Kumari\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/person\\\/e4f02009bfd7551339d8ae6a2c445559\"},\"headline\":\"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns\",\"datePublished\":\"2026-08-08T14:00:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/\"},\"wordCount\":349,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp\",\"keywords\":[\"ambcrypto\"],\"articleSection\":[\"Bitcoin\",\"News\",\"Social\",\"Trading View\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/\",\"name\":\"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp\",\"datePublished\":\"2026-08-08T14:00:15+00:00\",\"description\":\"Even though there are still more suspected cases, the confirmed loss currently stands at 1,719 Bitcoins worth $111 million.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\\\/#primaryimage\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp\",\"contentUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp\",\"width\":1600,\"height\":900,\"caption\":\"1719 BTC has been stolen from Coldcard victims\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#website\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/\",\"name\":\"AMBCrypto\",\"description\":\"Stay Ahead!\",\"publisher\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"},\"alternateName\":\"AMBCrypto News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ambcrypto.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\",\"name\":\"AMBCrypto\",\"alternateName\":\"AMBCrypto News\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/amb-wide.jpg\",\"width\":600,\"height\":60,\"caption\":\"AMBCrypto\"},\"image\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cryptoamb\",\"https:\\\/\\\/x.com\\\/CryptoAmb\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/13629485\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/person\\\/e4f02009bfd7551339d8ae6a2c445559\",\"name\":\"Ishika Kumari\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"contentUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"caption\":\"Ishika Kumari\"},\"description\":\"Ishika Kumari is a Crypto Analyst at AMBCrypto, specializing in regulatory developments, market dynamics, and blockchain\u2019s real-world impact. She breaks down complex protocols and legislation into practical, easy-to-understand insights.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/ishika-kumari-\\\/\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/IshikaAMBcrypto\"],\"knowsAbout\":[\"Technical Analysis\",\"Crypto Market Trends\",\"Crypto Market Analysis\"],\"jobTitle\":\"Journalist\",\"worksFor\":\"AMBCrypto\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/author\\\/ishika-kumari\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto","description":"Even though there are still more suspected cases, the confirmed loss currently stands at 1,719 Bitcoins worth $111 million.","robots":{"index":"index","follow":"follow","max-image-preview":"max-image-preview:large"},"canonical":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/","og_locale":"en_US","og_type":"article","og_title":"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto","og_description":"With more victims being found by investigators, could Coldcard losses actually surpass $130 million?","og_url":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/","og_site_name":"AMBCrypto","article_publisher":"https:\/\/www.facebook.com\/cryptoamb","article_published_time":"2026-08-08T14:00:15+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp","type":"image\/webp"}],"author":"Ishika Kumari","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/IshikaAMBcrypto","twitter_site":"@CryptoAmb","twitter_misc":{"Written by":"Ishika Kumari","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"ReportageNewsArticle","@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#article","isPartOf":{"@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/"},"author":{"name":"Ishika Kumari","@id":"https:\/\/ambcrypto.com\/#\/schema\/person\/e4f02009bfd7551339d8ae6a2c445559"},"headline":"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns","datePublished":"2026-08-08T14:00:15+00:00","mainEntityOfPage":{"@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/"},"wordCount":349,"commentCount":0,"publisher":{"@id":"https:\/\/ambcrypto.com\/#organization"},"image":{"@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#primaryimage"},"thumbnailUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp","keywords":["ambcrypto"],"articleSection":["Bitcoin","News","Social","Trading View"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/ambcrypto.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/","url":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/","name":"Coldcard exploit hits $111M as investigators uncover 25+ attack patterns - AMBCrypto","isPartOf":{"@id":"https:\/\/ambcrypto.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#primaryimage"},"image":{"@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#primaryimage"},"thumbnailUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp","datePublished":"2026-08-08T14:00:15+00:00","description":"Even though there are still more suspected cases, the confirmed loss currently stands at 1,719 Bitcoins worth $111 million.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ambcrypto.com\/coldcard-exploit-hits-111m-as-investigators-uncover-25-attack-patterns\/#primaryimage","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp","contentUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/1719-BTC-has-been-stolen-from-Coldcard-victims-e1786176124844.webp","width":1600,"height":900,"caption":"1719 BTC has been stolen from Coldcard victims"},{"@type":"WebSite","@id":"https:\/\/ambcrypto.com\/#website","url":"https:\/\/ambcrypto.com\/","name":"AMBCrypto","description":"Stay Ahead!","publisher":{"@id":"https:\/\/ambcrypto.com\/#organization"},"alternateName":"AMBCrypto News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ambcrypto.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/ambcrypto.com\/#organization","name":"AMBCrypto","alternateName":"AMBCrypto News","url":"https:\/\/ambcrypto.com\/","logo":{"@type":"ImageObject","@id":"https:\/\/ambcrypto.com\/#\/schema\/logo\/image\/","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/04\/amb-wide.jpg","width":600,"height":60,"caption":"AMBCrypto"},"image":{"@id":"https:\/\/ambcrypto.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cryptoamb","https:\/\/x.com\/CryptoAmb","https:\/\/www.linkedin.com\/company\/13629485\/"]},{"@type":"Person","@id":"https:\/\/ambcrypto.com\/#\/schema\/person\/e4f02009bfd7551339d8ae6a2c445559","name":"Ishika Kumari","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","contentUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","caption":"Ishika Kumari"},"description":"Ishika Kumari is a Crypto Analyst at AMBCrypto, specializing in regulatory developments, market dynamics, and blockchain\u2019s real-world impact. She breaks down complex protocols and legislation into practical, easy-to-understand insights.","sameAs":["https:\/\/www.linkedin.com\/in\/ishika-kumari-\/","https:\/\/x.com\/https:\/\/twitter.com\/IshikaAMBcrypto"],"knowsAbout":["Technical Analysis","Crypto Market Trends","Crypto Market Analysis"],"jobTitle":"Journalist","worksFor":"AMBCrypto","url":"https:\/\/ambcrypto.com\/author\/ishika-kumari\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts\/623279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/users\/66"}],"replies":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/comments?post=623279"}],"version-history":[{"count":0,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts\/623279\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/media\/623280"}],"wp:attachment":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/media?parent=623279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/categories?post=623279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/tags?post=623279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}