TFTC on Nostr: Galaxy Research is tracking the Coldcard hack in real time. They've identified three ...
Galaxy Research is tracking the Coldcard hack in real time.
They've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses.
The first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds.
Galaxy notes "the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings."
Not one coin taken was created before the vulnerable firmware shipped in March 2021.
Published at
2026-08-01 21:18:28 CESTEvent JSON
{
"id": "a00326f77e296737dbd6e0b67a7a8b98ccf24e928a07d86d0ad9f24b28633ed6",
"pubkey": "85bdb5875e113dcc99498b474636449882ee15a1c78154ab07c065b47339d672",
"created_at": 1785611908,
"kind": 1,
"tags": [
[
"imeta",
"url https://blossom.primal.net/30b9a855b7bb1b84af4b6c8c19794ffaec2c196ed635846fc18e94fd88ebfe64.jpg",
"m image/jpeg",
"x 30b9a855b7bb1b84af4b6c8c19794ffaec2c196ed635846fc18e94fd88ebfe64",
"size 103506"
]
],
"content": "Galaxy Research is tracking the Coldcard hack in real time.\n\nThey've identified three waves of sweeps so far: 1,367 BTC (~$88.6M) drained from 4,585 addresses.\n\nThe first wave hit 1,196 addresses in a 41-minute window, all paying an identical 30 sat/vB fee. Automated key scanning, not owners moving funds.\n\nGalaxy notes \"the loss profile is dominated by sub-1 BTC addresses in count, but by larger addresses in value. This appears to be the shape of individual self-custody, not institutional holdings.\"\n\nNot one coin taken was created before the vulnerable firmware shipped in March 2021.\nhttps://blossom.primal.net/30b9a855b7bb1b84af4b6c8c19794ffaec2c196ed635846fc18e94fd88ebfe64.jpg",
"sig": "63a8a092110d899120860fa0f9367e7689453ef538a96d15c7bbe4a434995738878ec44c7a300ae25d48fb0130994099c5e2cde5b18ef6678b8c4b7fa8074f3d"
}
