Blockchain analysts have linked a rapid series of Bitcoin wallet drains to a reported vulnerability in Coldcard firmware. A total of 1,196 addresses lost a combined 1,082.65 BTC, valued at approximately $70.2 million, in just 41 minutes on July 30, 2026.
Galaxy Research stated that its transaction-flow analysis was based on a pattern initially identified by Block engineers and publicly shared by researcher Clay Garrett.
The suspected theft took place between 01:10:20 and 01:51:26 UTC, spanning Bitcoin blocks 960,183 to 960,191. According to Galaxy Research, the sweep activity began roughly 30 hours before the hardware wallet vendor issued a public advisory.
While the available evidence does not definitively establish the attackers’ identity, the synchronized transaction behavior suggests automated theft rather than routine user transfers.
Galaxy Research found that 1,183 of the drained wallets used native SegWit BIP-84 address derivation. In contrast, seven used BIP-49 and six used legacy BIP-44 derivation paths.
This distribution may indicate that the attacker systematically scanned multiple hierarchical deterministic wallet derivation paths after gaining access to the affected key material.
Such scanning would allow a threat actor to locate balances stored across various address formats, including those that users may not actively monitor.
Every impacted address was reportedly emptied in full, with no change output created, reinforcing the assessment that an automated tool was used to spend from wallets whose private keys were already accessible to the operator.
A distinctive transaction fee pattern further distinguishes this incident from normal Bitcoin wallet activity. Each sweeping transaction paid an identical hardcoded fee rate of 30.0 sat/vB, despite the median network fee rate reportedly ranging between 0.4 and 1.0 sat/vB during that week.
This represented an estimated 30- to 75-fold overpayment. Hardcoded, above-market transaction fees are often associated with malware, bulk-draining scripts, or operational tools designed to prioritize confirmation speed over cost.
The lack of change outputs and the identical fee selection across hundreds of victim wallets suggest that the transactions were generated through a centralized process.
The stolen Bitcoin was quickly consolidated into four addresses holding approximately 562.02 BTC, 398.48 BTC, 89.62 BTC, and 32.45 BTC, respectively.
Galaxy Research reported that the consolidated funds had not moved at the time of publication. Coldcard users should verify any vendor advisories through official channels, review their device firmware versions, and avoid entering seed phrases into software or websites.
Potentially affected users should move their assets only after following verified remediation guidance, as unsafe migration procedures can expose wallet recovery phrases to compromise further.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…