Coldcard wallet exploit deepens as losses pass $88 million and Bitcoin tests $60,000

On 2 August 2026, estimates of bitcoin stolen from Coldcard-generated addresses crossed $88.6 million. The Hacker News Telegram channel, summarising Galaxy Research, put the running tally at 1,367.05 BTC across 4,585 addresses, up from a roughly $70 million reading a day earlier. CoinDesk, citing Galaxy, had logged a third wave of sweeps by 20:10 UTC on 1 August, with losses near $89 million spread across 4,500 addresses. A 1 August CoinDesk reconstruction traced the operation to weak seed generation rather than a breach of the physical devices, meaning the attackers appeared able to recreate private keys offline before draining wallets that had never been connected to a malicious signer.

That detail reframes the threat. Coldcards are sold as the most paranoid tier of self-custody: air-gapped, signed-only, marketed as immune to the malware that empties hot wallets. The exploit sits beneath the device, in the entropy used to derive a seed. If the keys can be reconstructed, the air gap is theatre. For an industry that has spent a decade arguing that "not your keys, not your coins" is the cleanest answer to counterparty risk, the optics are uncomfortable.

How the waves were labelled

The incident surfaced in stages, and the labeling shifted with it. The Telegram channel @WatcherGuru, a crypto-news account, posted on 31 July 2026 at 09:43 UTC that roughly $40 million in bitcoin had been stolen after 500 Coldcard hardware wallets were hacked. By 1 August 2026 at 05:55 UTC, CoinDesk's reconstruction cited Galaxy Research tallying 1,196 addresses that lost 1,082.65 BTC inside a 41-minute window, with losses framed at $70 million. Cointelegraph, citing Galaxy, carried the same figures the same day.

The wave numbering diverged across outlets. DarkWebInformer, on 1 August 2026 at 18:31 UTC, summarised Galaxy Research calling the activity a "2nd wave" with 1,158.81 BTC stolen from 2,673 addresses. CoinDesk, ninety minutes later at 20:10 UTC, summarised Galaxy calling the same activity a "third wave of sweeps" with losses near $89 million spread across 4,500 addresses. On 2 August 2026 at 01:22 UTC, DarkWebInformer again cited Galaxy using the "3rd wave" label. The Hacker News Telegram channel at 16:59 UTC on 2 August framed two additional sweep rounds as lifting the figure to $88.6 million, and noted that one of those rounds may involve a different operator. The headline loss has therefore moved as the labels have: $40 million on 31 July, $70 million on 1 August, over $88 million on 2 August, with each revision published before the previous total had time to settle.

CoinDesk's second-day reporting also flagged a behavioural shift in the most recent sweep wave: the attacker began targeting smaller balances and changing how funds were collected on-chain. The Hacker News summary attributed this pattern to the latest wave rather than to a between-waves pivot, which means the running characterisation of the attacker's evolving tactics is itself a moving target.

The macro overlay

The exploit landed inside an already nervous tape. On 31 July 2026 at 14:55 UTC, @WatcherGuru reported bitcoin had fallen back under $63,000 with $125 million liquidated from the crypto market in the previous 60 minutes. The same account logged the US 30-year bond yield reaching its highest level since 2007 at 18:30 UTC the same day, a signal that risk-asset pricing was being repriced against a stiffer long-rate backdrop. By 2 August 2026 at 20:15 UTC, Polymarket was pricing a 59% chance that bitcoin closes the month below $60,000.

Monexus analysis: the timing is the story. Hardware-wallet exploits erode the very claim of sovereignty that drew capital into self-custody in the first place. If users believe their seed can be reconstructed by a sufficiently patient adversary, the trust premium for cold storage collapses, and flows shift back toward custodians, exchanges, and the regulated intermediaries the original pitch was a rejection of. The exploit is not just a theft; it is a referendum on the architecture. The Polymarket contract is the cleanest available read on where the next leg might go, but it is also a derivative of sentiment inside an already-leveraged market, not an independent forecast.

What is actually contested

Three questions remain genuinely open. First, the source of the weak entropy. CoinDesk's 1 August analysis describes the failure mode in detail but the cited posts do not specify which firmware versions or which production batches produced the low-quality randomness. Until Coinkite, the manufacturer, or an independent reproducible build confirms the scope, the affected population has to be estimated from on-chain heuristics rather than from a disclosed bug list. Second, attribution. Galaxy Research calls the activity "suspected" Coldcard-linked sweeps; the language is careful, because the link runs through the addresses' derivation patterns, not through any on-chain signature tying funds to a known actor. A rival scenario, that the same on-chain fingerprint is shared by a non-Coldcard wallet implementation with similar entropy bugs, has not been ruled out by the cited reporting.

Third, the operator question. The Hacker News summary flagged that the latest wave may involve a different operator, which would mean the running tally conflates two distinct efforts rather than measuring a single sustained campaign. The cited reporting does not adjudicate that question. Readers should treat the running estimate as a moving target, the wave labels as provisional, and the attribution as suspected rather than confirmed.

Desk note: The wires treated this primarily as a security incident. Monexus framed it as a security-and-markets story, because the theft landed inside a bond-yield shock and a leveraged liquidation cascade, and the Polymarket contract is the cleanest available read on where the next leg might go.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://www.coindesk.com/tech/2026/08/01/how-bitcoin-cold-wallets-lost-usd70-million-in-an-attack-that-never-touched-the-devices
• https://cointelegraph.com/news/coldcard-bitcoin-loss-estimate-70-million-galaxy-analysis
• https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million
• https://t.me/thehackernews/9687
• https://t.me/watcherguru/14511
• https://t.me/watcherguru/14489
• https://t.me/watcherguru/14492
• https://t.me/watcherguru/14494
• https://poly.market/gLci8eN
• https://x.com/DarkWebInformer/status/2083725013862015340
• https://x.com/DarkWebInformer/status/2083621745525694885
• https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html