The Coldcard attack remains ongoing, and users should immediately migrate funds from their associated addresses.

Coldcard has been hacked, with stolen funds now totaling 1,367.05 BTC, valued at approximately $88.6 million, across 4,585 addresses. Galaxy Research Head Alex Thorn said the attack is ongoing, urging users who have not yet moved their funds to immediately transfer assets from addresses generated by Coldcard. He also called on affected users to voluntarily provide information to help track the stolen funds and report to law enforcement. Thorn noted that the three previously confirmed large-scale attacks exhibit clear procedural characteristics, with similar transaction patterns likely orchestrated automatically; the stolen BTC remains in the attackers’ addresses and has not been moved. However, smaller opportunistic attackers have emerged recently, transferring and laundering funds within hours, with some funds flowing to overseas gambling platforms via cross-chain services like ThorChain. All Coldcard single-sig addresses generated after the March 2021 firmware update may ultimately be compromised, so users should complete migration as soon as possible. The stolen funds had lain dormant for an average of 3.18 years, with a median of 3.55 years, and victims are primarily long-term holders. Thorn said most of the identified stolen assets remain unmoved, and the relevant addresses have been submitted to U.S. law enforcement and industry contacts. He views the incident as a major blow to Bitcoin self-custody, calling on the industry to improve security, education, and risk warnings about the complexities of self-custody.