Galaxy Research said on X that it suspects total Bitcoin losses from the Coldcard firmware vulnerability could swell to $130 million once a still-unconfirmed fourth wave of attacks is included, pushing the incident beyond the roughly $88.6 million already documented across three waves.
The research unit has tracked 1,367.05 BTC drained from 4,585 addresses since July 30, when the first wave emptied 1,082.65 BTC from 1,196 addresses in a 41-minute window. A second wave followed roughly 27 hours later, and a third wave added another 207.73 BTC from 1,912 addresses, with the average balance falling to just over 0.1 BTC per address — a shift suggesting attackers moved from larger holdings toward smaller wallets.
On August 3, Galaxy's head of research Alex Thorn warned that a fourth coordinated wave had swept 388.93 BTC across 218 transactions in about 2.5 hours, involving 462 victim addresses. Some funds from this wave have already reached second-hop addresses while additional transfers remained in the mempool with replace-by-fee enabled, meaning confirmed totals may still rise.