| Wat je moet weten |
|---|
| 1Galaxy-linked tracking now puts observed losses near 1,367.05 BTC. |
| 2The mapped set covers 4,585 addresses and three attack waves. |
| 3Alex Thorn warned on X that the attack remains active. |
| 4Small BTC transfers reached 39,600 BTC, near the November 2022 FTX level. |
Market context per 01.08 CEST. Bitcoin traded at $63,392 on Binance, 0.63% below its 24-hour high and 0.99% above its low. Binance BTCUSDT spot turnover was $529.0 million. Futures open interest stood at 109,105 BTC, worth about $6.91 billion, with a 0.01% funding rate. CoinGecko put 24-hour BTC volume near $15.65 billion.
Coldcard exploit loss map jumps again
Decrypt reported that Galaxy Research has identified a third wave of suspected Coldcard thefts. The new wave added 207.73 BTC and pushed the observed tally to roughly $88.6 million in the source report.
At the live Binance BTCUSDT price used for this run, 1,367.05 BTC equals about $86.7 million. Spread over 4,585 mapped addresses, that is about 0.298 BTC, or $18,901, per address. The third wave alone is 15.2% of the mapped BTC loss.
The earlier CryptoFocus coverage tracked a smaller Coldcard set and the first public custody warnings. This update is different because the mapped address count, the BTC total and the active-drain warning all moved higher.
Small Bitcoin transfers show the response
Cointelegraph’s market read, mirrored by TradingView, cited CryptoQuant data showing 39,600 BTC in sub-1 BTC transfers on Friday. That was only 300 BTC below the 39,900 BTC recorded on November 16, 2022, after FTX failed.
The CryptoFocus comparison is the sharper number. Those small transfers were about 29.0 times larger than the currently mapped stolen BTC. In other words, the visible defensive shuffle dwarfed the known loss tally.
That does not prove every transfer was a Coldcard rescue move. It does show that retail-sized Bitcoin wallets reacted at a scale normally seen during exchange stress.
Source warning narrows the user check
The public warning focuses on single-signature Coldcard setups generated after a March 2021 firmware upgrade. Thorn later narrowed that wording to setups without dice rolls, without a passphrase and with that firmware path.
Users should still avoid improvising with seed phrases under pressure. Coldcard’s own upgrade documentation and support page can help identify the device and firmware path. Large holders still need a calm recovery process.
The safer lesson is procedural. A hardware wallet is not a magic box. Seed generation, passphrases, firmware provenance and recovery checks all sit inside the custody risk.
The U.S. and global custody hook
For overnight U.S. readers, the tension is clear. Bitcoin ETFs solve operational custody for some investors, but they remove direct coin control. Self-custody keeps control, but it makes technical mistakes expensive.
The mapped loss equals 16.4% of Binance’s live 24-hour BTCUSDT spot turnover. It is only 1.25% of Binance BTC open interest, so this is not a broad market-liquidity shock. It is a confidence shock for long-term holders.
CryptoFocus previously covered CZ’s wallet-splitting advice after the earlier Coldcard reports. This update changes the question. Diversification helps only if exposed holders can still move before the attacker reaches them.
| What to watch now |
|---|
| 1New Galaxy Research totals for affected addresses and attacker wallets. |
| 2Any movement from the three large attacker holding patterns. |
| 3Coldcard or Coinkite statements that identify the exact affected firmware path. |
| 4Whether small BTC transfers stay elevated after the first response wave. |
This article is informational and not financial advice. Crypto assets carry a risk of loss. Verify wallet instructions with the original provider. Consider independent security help for large balances. Never enter a seed phrase into an untrusted device or website.
