{"id":625847,"date":"2026-08-18T01:30:33","date_gmt":"2026-08-18T05:30:33","guid":{"rendered":"https:\/\/ambcrypto.com\/?p=625847"},"modified":"2026-08-17T23:46:33","modified_gmt":"2026-08-18T03:46:33","slug":"coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details","status":"publish","type":"post","link":"https:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/","title":{"rendered":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details"},"content":{"rendered":"

It’s been 18 days, and the impact of the Coldcard exploit starting on 30th July is still being felt. Galaxy Research spoke to more than 200 victims on 16th August to understand the intelligence behind the attack.\u00a0<\/span><\/p>\n

The compromised coins were produced on the day the vulnerable Coldcard firmware was released. This happened on 17th March 2021, when Bitcoin [BTC] had reached a block height of 674,951. The timing is what makes this attack noteworthy since it also links the exploit to a seed-generation flaw. <\/span><\/p>\n

In such types of flaws, the illicit actors usually predict or forge the stolen wallet seed entropy.\u00a0<\/span><\/p>\n

\"losses<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

An assessment of the losses<\/h2>\n

Here, it’s worth noting that the time period between 2021 and 2022 saw the largest concentration of stolen addresses.<\/p>\n

Also, only a small percentage of the 8,680 addresses in Galaxy’s published theft set have been directly connected to victims who reported losses. This, even though they hold approximately 1,778.6 BTC<\/p>\n

\"Count<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

Additionally, all 192 individuals reported losses involving addresses in the dataset that was made public, which includes roughly 1,790 addresses and 714.8 Bitcoin<\/a>.<\/p>\n

AMBCrypto recently reported<\/a> that these losses surpassed 1,596 BTC worth more than $100 million across roughly 7,300 addresses. Given Bitcoin’s price on 16th August though, the total losses have now surpassed $115 million.<\/p>\n

What do we know about the attackers?<\/h2>\n

A few “fingerprints” were found during the investigation. These fingerprints were based on transaction behavior such as block timing, fees, lock times, RBF\/sequence settings, transaction structure, and destination addresses.<\/p>\n

Wave 1, for instance, stole roughly 1,082.65 BTC from blocks 960,183\u2013960,191. They typically moved one victim per transaction into four collection addresses.<\/p>\n

\"Attacker<\/a>
Source: Galaxy Research<\/figcaption><\/figure>\n

Similarly, Wave 3 managed 63 victims and Wave 2 handled 19 while Footprint E batched up to 795 victims per transaction, with a median of 118.<\/p>\n

Patterns of destination also differed, with some groups dispersing funds over hundreds of locations while others concentrated them into a few addresses.<\/p>\n

\n

Final Summary<\/h2>\n
    \n
  • Exploit affected 192 individuals, with roughly 714.8 Bitcoin compromised.<\/em><\/li>\n
  • Most of these significant losses happened between 2021 and 2022.<\/em><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    Why have losses continued 5 years after the vulnerable Coldcard firmware was released in 2021?<\/p>\n","protected":false},"author":66,"featured_media":625848,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[35,66,4,20],"tags":[],"class_list":["post-625847","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin-news","category-new-news","category-social","category-trading-view"],"acf":[],"yoast_head":"\nColdcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto<\/title>\n<meta name=\"description\" content=\"In this attack, Wave 3 managed 63 victims, Wave 2 had 19, while Footprint E batched up to 795 victims per transaction...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-image-preview:large\" \/>\n<link rel=\"canonical\" href=\"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto\" \/>\n<meta property=\"og:description\" content=\"Why have losses continued 5 years after the vulnerable Coldcard firmware was released in 2021?\" \/>\n<meta property=\"og:url\" content=\"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/\" \/>\n<meta property=\"og:site_name\" content=\"AMBCrypto\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cryptoamb\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-18T05:30:33+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Ishika Kumari\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/IshikaAMBcrypto\" \/>\n<meta name=\"twitter:site\" content=\"@CryptoAmb\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ishika Kumari\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"ReportageNewsArticle\",\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#article\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/\"},\"author\":{\"name\":\"Ishika Kumari\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/person\\\/e4f02009bfd7551339d8ae6a2c445559\"},\"headline\":\"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details\",\"datePublished\":\"2026-08-18T05:30:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/\"},\"wordCount\":355,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"},\"image\":{\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp\",\"articleSection\":[\"Bitcoin\",\"News\",\"Social\",\"Trading View\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/\",\"url\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/\",\"name\":\"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#primaryimage\"},\"image\":{\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp\",\"datePublished\":\"2026-08-18T05:30:33+00:00\",\"description\":\"In this attack, Wave 3 managed 63 victims, Wave 2 had 19, while Footprint E batched up to 795 victims per transaction...\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"http:\\\/\\\/ambcrypto.com\\\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\\\/#primaryimage\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp\",\"contentUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp\",\"width\":1600,\"height\":900,\"caption\":\"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#website\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/\",\"name\":\"AMBCrypto\",\"description\":\"Stay Ahead!\",\"publisher\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\"},\"alternateName\":\"AMBCrypto News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/ambcrypto.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#organization\",\"name\":\"AMBCrypto\",\"alternateName\":\"AMBCrypto News\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/amb-wide.jpg\",\"width\":600,\"height\":60,\"caption\":\"AMBCrypto\"},\"image\":{\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cryptoamb\",\"https:\\\/\\\/x.com\\\/CryptoAmb\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/13629485\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/#\\\/schema\\\/person\\\/e4f02009bfd7551339d8ae6a2c445559\",\"name\":\"Ishika Kumari\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"contentUrl\":\"https:\\\/\\\/ambcrypto.com\\\/wp-content\\\/uploads\\\/2026\\\/02\\\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg\",\"caption\":\"Ishika Kumari\"},\"description\":\"Ishika Kumari is a Crypto Analyst at AMBCrypto, specializing in regulatory developments, market dynamics, and blockchain\u2019s real-world impact. She breaks down complex protocols and legislation into practical, easy-to-understand insights.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/ishika-kumari-\\\/\",\"https:\\\/\\\/x.com\\\/https:\\\/\\\/twitter.com\\\/IshikaAMBcrypto\"],\"knowsAbout\":[\"Technical Analysis\",\"Crypto Market Trends\",\"Crypto Market Analysis\"],\"jobTitle\":\"Journalist\",\"worksFor\":\"AMBCrypto\",\"url\":\"https:\\\/\\\/ambcrypto.com\\\/author\\\/ishika-kumari\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto","description":"In this attack, Wave 3 managed 63 victims, Wave 2 had 19, while Footprint E batched up to 795 victims per transaction...","robots":{"index":"index","follow":"follow","max-image-preview":"max-image-preview:large"},"canonical":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/","og_locale":"en_US","og_type":"article","og_title":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto","og_description":"Why have losses continued 5 years after the vulnerable Coldcard firmware was released in 2021?","og_url":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/","og_site_name":"AMBCrypto","article_publisher":"https:\/\/www.facebook.com\/cryptoamb","article_published_time":"2026-08-18T05:30:33+00:00","og_image":[{"width":1600,"height":900,"url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp","type":"image\/webp"}],"author":"Ishika Kumari","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/IshikaAMBcrypto","twitter_site":"@CryptoAmb","twitter_misc":{"Written by":"Ishika Kumari","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"ReportageNewsArticle","@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#article","isPartOf":{"@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/"},"author":{"name":"Ishika Kumari","@id":"https:\/\/ambcrypto.com\/#\/schema\/person\/e4f02009bfd7551339d8ae6a2c445559"},"headline":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details","datePublished":"2026-08-18T05:30:33+00:00","mainEntityOfPage":{"@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/"},"wordCount":355,"commentCount":0,"publisher":{"@id":"https:\/\/ambcrypto.com\/#organization"},"image":{"@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#primaryimage"},"thumbnailUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp","articleSection":["Bitcoin","News","Social","Trading View"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/ambcrypto.com\/#organization"}},{"@type":"WebPage","@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/","url":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/","name":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details - AMBCrypto","isPartOf":{"@id":"https:\/\/ambcrypto.com\/#website"},"primaryImageOfPage":{"@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#primaryimage"},"image":{"@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#primaryimage"},"thumbnailUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp","datePublished":"2026-08-18T05:30:33+00:00","description":"In this attack, Wave 3 managed 63 victims, Wave 2 had 19, while Footprint E batched up to 795 victims per transaction...","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"http:\/\/ambcrypto.com\/coldcard-exploit-reveals-years-long-bitcoin-theft-campaign-details\/#primaryimage","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp","contentUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/08\/Coldcard-losses-have-exceeded-115M--e1786975442266.webp","width":1600,"height":900,"caption":"Coldcard exploit reveals years-long Bitcoin theft campaign \u2014 Details"},{"@type":"WebSite","@id":"https:\/\/ambcrypto.com\/#website","url":"https:\/\/ambcrypto.com\/","name":"AMBCrypto","description":"Stay Ahead!","publisher":{"@id":"https:\/\/ambcrypto.com\/#organization"},"alternateName":"AMBCrypto News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ambcrypto.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/ambcrypto.com\/#organization","name":"AMBCrypto","alternateName":"AMBCrypto News","url":"https:\/\/ambcrypto.com\/","logo":{"@type":"ImageObject","@id":"https:\/\/ambcrypto.com\/#\/schema\/logo\/image\/","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/04\/amb-wide.jpg","width":600,"height":60,"caption":"AMBCrypto"},"image":{"@id":"https:\/\/ambcrypto.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cryptoamb","https:\/\/x.com\/CryptoAmb","https:\/\/www.linkedin.com\/company\/13629485\/"]},{"@type":"Person","@id":"https:\/\/ambcrypto.com\/#\/schema\/person\/e4f02009bfd7551339d8ae6a2c445559","name":"Ishika Kumari","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","url":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","contentUrl":"https:\/\/ambcrypto.com\/wp-content\/uploads\/2026\/02\/PXL_20240214_1253136702-scaled-e1770707767398-100x100.jpg","caption":"Ishika Kumari"},"description":"Ishika Kumari is a Crypto Analyst at AMBCrypto, specializing in regulatory developments, market dynamics, and blockchain\u2019s real-world impact. She breaks down complex protocols and legislation into practical, easy-to-understand insights.","sameAs":["https:\/\/www.linkedin.com\/in\/ishika-kumari-\/","https:\/\/x.com\/https:\/\/twitter.com\/IshikaAMBcrypto"],"knowsAbout":["Technical Analysis","Crypto Market Trends","Crypto Market Analysis"],"jobTitle":"Journalist","worksFor":"AMBCrypto","url":"https:\/\/ambcrypto.com\/author\/ishika-kumari\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts\/625847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/users\/66"}],"replies":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/comments?post=625847"}],"version-history":[{"count":0,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/posts\/625847\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/media\/625848"}],"wp:attachment":[{"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/media?parent=625847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/categories?post=625847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ambcrypto.com\/wp-json\/wp\/v2\/tags?post=625847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}