Coldcard exploit losses top $100M as phishing wave targets hardware wallet users

Bitcoin losses tied to the ongoing Coldcard hardware wallet exploit have surpassed $100 million, according to Galaxy Research, with one market commentator noting that stolen BTC may be difficult to spend because the movement of funds remains visible on the public blockchain. The incident continues to drain wallets in multiple waves, as additional reporting points to ongoing outflows even after earlier theft estimates ^{[1] [2]}.

Wallet-security firms are also warning of an accompanying phishing surge, stating that attackers are using fake “coordinated hardware audit” emails to direct users to a cloned Coldcard site that can install remote-access software. Coverage from Crypto Briefing similarly frames the exploit as a self-custody risk and points to potential shifts toward stronger security practices, including multi-signature approaches ^{[3] [4]}.

Coldcard-linked theft figures continue to rise, while industry warnings highlight phishing tactics aimed at compromising additional holders alongside the underlying exploit ^{[1] [3] [4]}.