Coldcard-linked losses top $88.6M as a third sweep wave hits 4,585 addresses

Estimated losses tied to Coldcard-generated Bitcoin addresses climbed past $88.6 million by 16:59 UTC on 2 August 2026, according to The Hacker News, which cited Galaxy Research figures of 1,367.05 BTC swept across 4,585 addresses. The running total is now more than double the $38 million figure that surfaced on 31 July 2026, and the address count has expanded sharply in the same window.

The incident has exposed an uncomfortable property of self-custody hardware: the attacker appears to have drained wallets without ever touching the devices. The flaw sits in the random-number generation that produced the seed phrases on a subset of Coldcard units. Once a candidate key matches an on-chain address holding funds, the funds are swept, and the user sees a balance fall to zero on a device still sitting in a drawer.

A drain that never touched the device

CoinDesk's reporting on 1 August 2026 summarised the mechanism as a wallet drain that "never touched the devices", noting that Galaxy had identified 1,196 addresses that lost 1,082.65 BTC inside a 41-minute window at the start of the incident. Cointelegraph, also on 1 August, framed the loss estimate at $70 million on the strength of the same Galaxy analysis.

The technical detail matters because it reframes who is responsible. This is not a phishing campaign against individual users, and there is no evidence in the cited material of a malicious firmware update or a supply-chain interdiction of devices in transit. It is a weakness in the entropy layer that supposedly underwrites self-custody. The attacker did not need to break into a chip; they appear to have had a statistical shortcut that, given enough compute, lets them reconstruct keys that should have been unrecoverable. The available source items do not specify which firmware versions or production windows are implicated, and this publication has not independently established whether a vendor advisory names them.

Three waves, four days, and an open question about who is sweeping

The public timeline compresses the scale of the problem. On 31 July 2026 at 16:05 UTC, a Polymarket post on X relayed that Coldcard had urged users to move their Bitcoin after a random-number flaw was linked to the theft of 594 BTC worth about $38 million. By 1 August, media coverage citing Galaxy's analysis had lifted the figure to roughly $70 million across 1,082.65 BTC at 1,196 addresses.

A second wave was identified by Galaxy Research and relayed by DarkWebInformer on X at 18:31 UTC on 1 August 2026: 1,158.81 BTC swept from 2,673 addresses. A third wave followed within hours. The Hacker News reported at 16:59 UTC on 2 August that the running total stood at 1,367.05 BTC across 4,585 addresses, with losses estimated at $88.6 million. Separately, Cointelegraph on 2 August cited CryptoQuant's on-chain team as saying the event triggered the largest volume of sub-1 BTC Bitcoin transfers since the FTX collapse in November 2022, with 39,600 BTC moving in small transactions as users scrambled to consolidate or migrate balances.

Monexus analysis: the dominant read is that a single attacker, armed with the same offline key-recovery method, is sweeping the queue. The Hacker News update, however, flags that the third wave "may involve a different operator". That caveat is worth holding onto. If a second party is in fact sweeping the same address set, the episode shifts from a single-vendor breach into something closer to a feeding frenzy on a known-weak keyspace, with consequences for how the remaining balances should be prioritised.

What this means for the self-custody pitch

The episode lands on a market that has spent several years telling retail users to take their coins off exchanges and onto hardware. That advice was always conditional: it assumed the device could be trusted. The cited coverage does not establish how Coldcard is responding to the entropy question beyond the 31 July user warning relayed by Polymarket on X, and the available source items do not specify whether a firmware fix has been issued or whether refunds or reimbursements are being discussed.

The structural read is straightforward. As Bitcoin holdings mature and more users move coins into long-term storage, the marginal cost of a flawed random-number generator rises with the size of each balance. A breach that touches 4,585 addresses is, in absolute terms, modest against the global holder base. In relative terms, against a fixed supply of devices and a finite window in which to sweep, it is large enough to reset the cost-benefit calculation for any user deciding whether to keep a meaningful balance on a single-vendor device, and it raises a sharper question about diversification across vendors and across key-derivation paths.

What to watch next

Three indicators will shape the story over the coming week. First, the on-chain sweep pace: the third wave suggests it has not decelerated, and a fourth wave would extend the address count further. Second, attribution: The Hacker News has relayed the possibility that the third sweep involves a different operator, and confirmation one way or the other would change the framing from a single-actor incident to a multi-actor race against the same weak keyspace. Third, vendor disclosure: whether Coldcard publishes a post-mortem that names the firmware versions or production windows affected, given that the available source items do not specify whether one has been issued.

The harder question is whether the market treats the event as a Coldcard problem or as a category problem. Custody is sold on the promise that mathematics, not intermediaries, is the last line of defence. The numbers now sitting in the attacker's wallets are a reminder that mathematics has dependencies too, and that the same dependency, once public, attracts more than one actor.

This article is a news desk piece. Monexus framed it as a supply-chain security event in the self-custody stack, with the on-chain data series as the primary record, the vendor's public warning as a developing input, and the third-wave attribution caveat surfaced explicitly rather than smoothed over.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://cointelegraph.com/news/coldcard-biggest-sub-1-btc-transfer-ftx-cryptoquant
• https://cointelegraph.com/news/coldcard-bitcoin-loss-estimate-70-million-galaxy-analysis
• https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices
• https://t.me/thehackernews/9687
• https://x.com/Polymarket/status/2083222613799616530
• https://x.com/DarkWebInformer/status/2083725013862015340
• https://x.com/DarkWebInformer/status/2083621745525694885