Coldcard wallet breach deepens to $89 million as Galaxy flags a third wave of sweeps

At 2026-08-02T20:15 UTC, the prediction market Polymarket put the odds of bitcoin falling below $60,000 before month's end at 59 percent, with the contract trading under the slug "Bitcoin hits $60K before August". The market sat less than 24 hours after onchain investigators confirmed a third wave of sweeps against addresses tied to compromised Coldcard hardware wallets, with cumulative losses now estimated at $88.6 million.

The collision is hard to ignore: the most publicised cold-storage failure of 2026 is unfolding while bitcoin trades under pressure and short positioning builds. The wallet story is a security story first. The market story sits downstream of it.

A breach that never touched the device

The mechanism is the part that has unsettled even seasoned custodians. Galaxy Research told CoinDesk on 2026-08-01 that the attacker never accessed the Coldcard devices themselves. Instead, weak seed-phrase generation allowed the operator to recreate likely private keys offline and sweep funds without ever pinging the hardware. Cointelegraph's parallel write-up on 2026-08-01 placed the first-wave toll at 1,082.65 bitcoin lost across 1,196 addresses inside a 41-minute window.

The initial public tally on 2026-07-31T09:43 UTC, posted by WatcherGuru, cited roughly $40 million in losses across about 500 wallets. By 2026-08-01T18:31 UTC, Galaxy Research had identified a second wave of sweeps totalling 1,158.81 BTC across 2,673 addresses, which Dark Web Informer relayed on X. By 2026-08-02T01:22 UTC, a third wave was confirmed, with the cumulative bitcoin loss rising to 1,367.05 BTC across 4,585 addresses and dollar losses climbing to approximately $88.6 million, according to The Hacker News's update that afternoon.

What changes in the third wave

Galaxy Research's August 2 read, summarised by The Hacker News and CoinDesk, is that the operator is now sweeping smaller balances and has altered how it consolidates funds onchain. The earlier waves concentrated on high-value targets. The third wave is breadth-first.

That has two practical consequences. First, the address count is rising faster than the dollar figure, because the marginal victim is now a smaller holder. Second, the change in consolidation patterns suggests the operator is responding to address-clustering heuristics that investigators and exchanges use to flag stolen coins: if the routing has shifted, the operator is reading the same blockchain analytics that the victims are paying for.

Monexus analysis: the migration from whale-hunting to dust-collection is a tell. Operators with the patience and the key-generation insight to recreate Coldcard seeds offline do not normally need to scrape small balances to make the operation worthwhile. The shift suggests either (a) the high-value address list is now largely drained, or (b) the operator is preparing to move a much larger pool of coins and wants the smaller sweeps to be invisible against that later movement.

What Coldcard itself has said

The source items in this thread do not specify any public statement from Coinkite, the Canadian manufacturer of Coldcard, beyond the device's existing security architecture. Galaxy Research's framing, as carried by CoinDesk and Cointelegraph, treats the failure as a weakness in the entropy or random-number generation underpinning certain wallet setups, not a vulnerability in the device firmware itself. The distinction matters for liability and for the dozens of vendors whose devices share underlying components.

The market backdrop

The wallet story is unfolding against a stressed backdrop. On 2026-07-31T14:55 UTC, WatcherGuru reported bitcoin falling back under $63,000 with $125 million in liquidations across the crypto market in the preceding hour. The same day, at 2026-07-31T18:30 UTC, the US 30-year Treasury yield touched its highest level since 2007, per WatcherGuru's relay of US market data. The Polymarket contract pricing 59 percent odds of a sub-$60,000 print by month-end, captured at 2026-08-02T20:15 UTC, reflects that liquidity pressure.

Monexus assessment: the wallet breach is not the proximate cause of the price action. But it has tightened the leash on an already nervous market. Custodians and large holders are reportedly reviewing their Coldcard setups and, in some cases, rotating funds to alternative signing schemes, which adds to short-term selling pressure independent of the macro rates story.

What remains contested

The source set gives no first-party statement from Coinkite confirming or contesting Galaxy's characterisation of the seed-generation weakness. It also does not specify whether the affected wallets share a common firmware version, a common production batch, or a common software front-end used during setup. The total dollar figure is also moving: $40 million on 2026-07-31, $70 million on 2026-08-01, and $88.6 million on 2026-08-02, each tied to a different Galaxy Research estimate and a different number of swept addresses. A reader should treat the most recent figure as the most current snapshot, not a final number.

The investigator community has converged on the broad shape of the attack. The grain of the onchain evidence (rapid-fire sweeps, common funding patterns, evolving consolidation routines) is consistent with a single operator or a tight cluster of operators working from a shared key-generation exploit. What has not been publicly verified is the identity of that operator, the channel through which the affected wallets were originally set up, and whether any exchange has successfully frozen a material portion of the swept funds.

Stakes and what to watch

If the third-wave pace continues, the address count will probably keep climbing faster than the dollar total, because each marginal victim is now a smaller holder. Two things are worth watching in the next 72 hours: any public statement from Coinkite or its resellers, and any onchain move that consolidates the swept coins into a single cluster large enough to be flagged and potentially frozen by a major exchange.

The broader lesson is structural. Hardware wallets are sold as the last line of defence in self-custody. The Coldcard incident shows that the line is only as strong as the entropy underpinning the seed, and that an attacker who can model that entropy offline can drain wallets at scale without ever needing physical or remote access to the device itself. For the industry, that is the sentence to argue with. For holders, it is the sentence to act on.

This article sits at the intersection of two Monexus desks. The crypto desk treats the breach as a security story grounded in Galaxy Research's onchain forensics. The markets desk treats the surrounding price action as macro liquidity and rates news, with the wallet story as a contributing rather than primary driver. Both framings are accurate; neither is sufficient on its own.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://poly.market/gLci8eN
• https://x.com/Polymarket/status/2084010260914647444
• https://t.me/watcherguru/14511
• https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million
• https://cointelegraph.com/news/coldcard-bitcoin-loss-estimate-70-million-galaxy-analysis
• https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices
• https://t.me/watcherguru/14494
• https://t.me/watcherguru/14492
• https://t.me/watcherguru/14489
• https://t.me/thehackernews/9687
• https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html
• https://x.com/DarkWebInformer/status/2083725013862015340
• https://x.com/DarkWebInformer/status/2083621745525694885