Analysts have questioned the small team and scale of operations of Coldcard maker Coinkite, and called it a “red flag.”
- On-chain analyst Willy Woo put the chances of stolen Coldcard Bitcoin ever being recovered at only 20% to 40%, warning that any recovery process could take years.
- The exploit was especially damaging, Woo said, because it targeted users who kept their crypto in self-custody rather than on exchanges, shaking confidence in the security of hardware wallets.
- Galaxy Digital’s Alex Thorn pointed to what looked like a fourth wave of coordinated attacks, with hundreds of BTC transferred from hundreds of victim wallets in a few hours.
One of the biggest Bitcoin hardware wallet exploits in recent years may still be unfolding. On-chain analyst Willy Woo said on Sunday that there was only a 20% to 40% chance that Bitcoin (BTC) stolen in the Coldcard hardware wallet exploit would be partially recovered by authorities and that it is likely to take multiple years for any recovery. Meanwhile, Galaxy Digital’s Alex Thorn said that blockchain activity hinted at a “likely 4th organized wave” of Coldcard attacks.
Why Recovery Could Take Years
On X, Woo said the exploit was damaging because it struck at the core of self-custody.
To support his estimate, he compiled a recovery history of major crypto hacks, which showed that Binance (BNB) recovered 100% for users through its SAFU fund after losing roughly 7,000 BTC in 2019, and Poly Network witnessed about 95% of $610 million returned voluntarily in 2021.
On the other end, Mt. Gox had recovered only 16 to 20% across proceedings between 2014 and 2026, and Bybit’s $1.5 billion hack last year had only 3% recovered so far, according to Woo’s post.
The analyst shared a post from JAN3 CEO Samson Mow who said the vulnerability “may be worse than an exchange hack” because “it hit those who did all the research, understood why self-custody is important, and didn’t keep coins on exchanges.”
Galaxy Digital Flags Potential Wave Of Wallet Drains
Woo’s warning came as Galaxy Digital’s (GLXY) head of research Alex Thorn talked about a “likely 4th organized wave” of Coldcard attacks on the same day. Thorn said 388.93 BTC had been removed from 462 victim addresses to 216 freshly created destinations over roughly two hours, later updating his estimate to 448.7 BTC across 709 addresses.
The sweep rate was 13.8 transactions per block, or about 45 times the baseline. Similar transactions were still sitting in the mempool, giving affected users a small window to broadcast a competing transaction with a higher fee to rescue their funds, according to Thorn.
Including the fourth wave, total damage from the exploit now exceeded 1,367 BTC, worth roughly $86.6 million, drained from thousands of wallets since the first attack on July 30.
Analyst Calls It A ‘Red Flag’
Coldcard parent Coinkite, which employs only about five people, was also weighed in on by Bloomberg analyst Eric Balchunas. He called it a “red flag.” “Would you use a bank to store your life’s savings that had 5 people working there and was located in Canada?” he wrote.
Bitcoin’s price was down over 1% during the past 24 hours. On Stocktwits, the retail sentiment around BTC remained in the ‘bearish’ zone, while chatter around it stayed at ‘normal’ levels over the past day.
Read also: S&P 500 Held Flat Last Month Despite Surging 10Y Treasury Yields — Wall Street’s ‘Dean Of Valuation’ Says Risk Math Hasn’t Changed
For updates and corrections, email newsroom[at]stocktwits[dot]com.<