Coldcard Wallet Exploit Linked to $114.7 Million in Stolen Bitcoin

Galaxy Research has attributed the theft of 1,789.28 BTC — worth approximately $114.7 million — from 8,865 addresses to an exploit targeting Coldcard, a hardware wallet used for self-custody of cryptocurrency. Of the 221 victim reports analysed, covering 790.72 BTC in losses, more than half involved losses exceeding 1 BTC, underscoring how severely individual users were affected.

The findings highlight a growing risk for businesses and individuals who rely on self-custody wallets to store digital assets. While hardware wallets are generally considered a more secure alternative to exchange-based storage, this incident shows that no storage method is immune to exploitation if vulnerabilities exist in the device or its supporting software.

Australian small businesses that hold or transact in cryptocurrency should take note. As digital assets become more common in business operations, understanding the risks associated with self-custody tools — and keeping firmware and software updated — is essential to avoiding costly losses.