Developing story update (August 09, 2026, 03:04 UTC):
Team formed after Coldcard's $130 MILLION exploit finds 4,962 flaws across 390 Bitcoin projects using AI. The Bitcoin Red Team used Kimi K3, GPT Sol, and Opus to scan wallets, libraries, and. Team formed after Coldcard's $130 MILLION exploit finds 4,962 flaws across 390 Bitcoin projects using AI. The Bitcoin Red Team used Kimi K3, GPT Sol, and Opus to scan wallets, libraries, and infrastructure in under 30 hours, averaging "1 critical exploit per hour." The team found 85 critical flaws while the effort cost $40,000 in AI credits funded by OpenSats, based on our sources
Developing story update (August 04, 2026, 00:55 UTC):
UPDATE: Coldcard exploit losses exceed $100 MILLION with 1,596 BTC stolen from over 7,300 wallets. Including the unconfirmed fourth wave, total losses could reach $130 MILLION (2,055 BTC). 90% of sto. UPDATE: Coldcard exploit losses exceed $100 MILLION with 1,596 BTC stolen from over 7,300 wallets. Including the unconfirmed fourth wave, total losses could reach $130 MILLION (2,055 BTC). 90% of stolen coins have not moved, Galaxy is providing attacker addresses to US federal law enforcement.
Developing story update (August 03, 2026, 01:39 UTC):
New detail on the timeline: based on our sources, the bulk of the losses came from a single burst on July 30, when an attacker emptied 1,082.65 BTC, worth roughly $70.2 million at the time, from 1,196 affected addresses in about 41 minutes. That accounts for most of the running total of roughly 1,367 BTC across 4,585 addresses.
The speed matters for traders. A drain of that size in under an hour points to automated, pre-positioned tooling exploiting the March 2021 firmware RNG flaw, not a slow manual sweep, which raises the odds that remaining vulnerable balances are targeted just as quickly. Headline totals are otherwise unchanged.
What to watch now: Whether fresh large single-transaction drains appear, signaling still-exposed Coldcard balances being swept.
Developing story update (August 03, 2026, 00:56 UTC):
Update: fresh tracking has broken out the largest single wave of this Coldcard exploit. On July 30 an attacker is reported to have drained 1,082.65 BTC, worth roughly $70.2 million at the time, from 1,196 separate addresses in about 41 minutes based on our sources.
That single burst accounts for the bulk of the roughly $88.6 million and 1,367 BTC now tied to the flaw across 4,585 addresses. The headline totals are unchanged from our earlier report, and the drains remain ongoing, so the practical takeaway for anyone on affected firmware is unchanged: treat those funds as exposed and move them.
What to watch now: Whether a fourth wave pushes total losses above the current ~$88.6M as remaining vulnerable addresses are swept.
Developing story update (August 02, 2026, 23:52 UTC):
Our latest intelligence confirms a key detail regarding the July 30 Coldcard exploit. The attack, which siphoned 1,082.65 BTC from 1,196 addresses, was executed with remarkable speed, completing in just 41 minutes.
This rapid execution highlights the automated and sophisticated nature of the exploit, reinforcing the urgency for affected users to take immediate action and review their security protocols.
What to watch now: Monitor for any further details on the exploit's execution speed or new mitigation strategies from Coldcard.
Developing story update (August 02, 2026, 23:11 UTC):
Our latest intelligence confirms the Coldcard exploit’s total observed losses have now reached approximately $88.6 million. This is a slight increase from previously reported figures, indicating the ongoing nature of the compromise.
Further analysis reveals the theft is not a single event but involves three distinct waves of activity. This structured approach by the attackers suggests a methodical draining process rather than an isolated incident.
The continued progression of this exploit, now with a clearer understanding of its multi-wave nature, reinforces the underlying security concerns in the hardware wallet space. Traders should remain vigilant for any further market reactions as this story develops.
What to watch now: Monitor for further movements of stolen funds and any official responses from Coldcard or regulatory bodies.
Developing story update (August 02, 2026, 22:50 UTC):
Our latest intelligence confirms the attacker behind the Coldcard exploit still holds the full $88.6 million in stolen Bitcoin. This indicates no immediate liquidation or movement of the funds, providing a clearer picture of the current state of the compromised assets.
Additionally, based on our sources, Galaxy Research has been identified as the entity that meticulously mapped the sweeps and definitively linked them to the flawed random number generator in Coldcard’s firmware. This attribution solidifies the technical understanding of the vulnerability.
What to watch now: Monitor for any movement of the stolen funds by the attacker and further official statements from Coldcard.
Developing story update (August 02, 2026, 22:08 UTC):
Our latest intelligence confirms critical new details regarding the Coldcard exploit. The vulnerability is now understood to stem from a flawed random number generator in the March 2021 firmware update, which directly exposed users’ seed phrases.
This technical clarification underscores the severity of the ongoing threat. Based on our sources, researchers are now warning that every device affected by this specific vulnerability will eventually be emptied, indicating a persistent and unavoidable risk for compromised wallets.
What to watch now: Monitor for further wallet drains and any official guidance or mitigation strategies from Coldcard or security experts.
Developing story update (August 02, 2026, 21:26 UTC):
Our sources confirm a slight increase in the total observed losses from the ongoing Coldcard hardware wallet exploit. The total amount of Bitcoin stolen has risen to approximately 1,367.05 BTC, with the estimated dollar value now reaching $88.6 million.
The exploit, linked to a March 2021 firmware update that exposed seed phrases, continues to impact affected users. This ongoing situation underscores the importance of hardware wallet security.
What to watch now: Monitor for further updates on the total stolen amounts and any new developments regarding the exploit's containment.
Developing story update (August 02, 2026, 21:05 UTC):
Our latest intelligence confirms the Coldcard exploit specifically compromises users’ seed phrases, directly exposing the private keys to affected wallets. This clarifies the mechanism of the ongoing theft and underscores the severity of the vulnerability.
In response to the exploit, we are observing a notable increase in Bitcoin exchange deposits and movement from previously dormant wallets. This market activity suggests some users are reacting by consolidating or moving funds, potentially contributing to short-term market volatility.
Traders should continue to monitor these on-chain metrics for further indications of market sentiment and potential price impacts, especially as Bitcoin approaches key support levels.
What to watch now: Watch for continued shifts in exchange deposit volumes and further activation of dormant Bitcoin addresses as the market processes this information.
Developing story update (August 02, 2026, 20:45 UTC):
The Coldcard Bitcoin exploit has seen a slight increase in reported total losses, now at approximately 1,367.05 BTC, valued at $88.6 million. This represents an incremental update to the previously reported figures.
New details confirm that an initial sweep on July 30 was particularly impactful, draining 1,082.65 BTC, worth about $70.2 million, from 1,196 addresses in a concentrated 41-minute period. This provides a clearer timeline of the attack’s execution.
What to watch now: Monitor for further details on the remaining two waves of theft and any official response from Coldcard or regulators.
Developing story update (August 02, 2026, 20:24 UTC):
Our latest checks confirm the Coldcard exploit’s total observed losses have been refined to approximately $88 million, a slight adjustment from previous reports. The amount of Bitcoin stolen remains at 1,367 BTC, affecting 4,585 addresses across three distinct waves.
A new development indicates that Galaxy Research is now actively tracking and mapping the exploit’s activity. This involvement brings additional scrutiny and analysis to the ongoing situation, which continues to drain funds from affected wallets.
For traders, the exploit remains a key factor to watch for potential short-term market sentiment shifts, particularly regarding hardware wallet security and retail investor confidence. We continue to monitor for any further official statements or significant changes in the exploit’s scope.
What to watch now: Monitor for further updates from Coldcard or tracking entities like Galaxy Research regarding the exploit's progression and any potential mitigation strategies.
Developing story update (August 02, 2026, 19:42 UTC):
Our sources confirm new details regarding the Coldcard exploit, identifying a firmware flaw from a March 2021 update as the root cause. This vulnerability is specifically linked to weak seed generation or exposed seed phrases, providing clarity on how the substantial losses occurred.
The total observed loss remains at approximately 1,367 BTC, valued at $88.6 million, affecting 4,585 addresses across three distinct waves. While the total stolen amount has not increased since our initial report, the identification of the specific flaw is a critical development for affected users and the broader hardware wallet security landscape.
Traders should monitor for any official responses or further technical analyses from Coldcard or security researchers. This new information reinforces the importance of robust security practices and could influence sentiment around hardware wallet reliability, potentially contributing to the cautious market outlook.
What to watch now: Monitor for any official statements from Coldcard regarding the identified firmware flaw and potential mitigation steps for affected users.
Developing story update (August 02, 2026, 19:21 UTC):
Our sources indicate a critical development in the Coldcard exploit, with researchers now warning that every vulnerable Coldcard device is expected to be emptied eventually. This suggests the ongoing nature of the theft could lead to further significant losses for affected users.
We have also obtained more granular details regarding the initial attack on July 30. This first wave saw 1,196 Bitcoin addresses drained in just 41 minutes, resulting in the theft of approximately 1,082.65 BTC, valued at about $70.2 million at the time.
Market reactions have been observed, with exchange deposits spiking following the initial thefts. Additionally, old, dormant Bitcoin wallets have shown activity, indicating broader market sensitivity and potential shifts in investor behavior in response to the exploit.
What to watch now: Monitor for further movements from compromised wallets and any official statements from Coldcard or affected exchanges.
Developing story update (August 02, 2026, 19:00 UTC):
Our latest intelligence confirms the Coldcard exploit’s initial thefts began on July 30. This new detail provides a clearer timeline for the ongoing security breach.
The total stolen Bitcoin is now precisely reported at 1,367.05 BTC, valued at approximately $88.6 million, affecting 4,585 addresses. Draining of compromised wallets is still underway, indicating the situation remains active.
For traders, this reinforces the critical importance of robust security practices. While the market impact on Bitcoin’s price remains limited, the ongoing nature of the exploit suggests continued vigilance is warranted.
What to watch now: Traders should continue to monitor for further official statements and any changes in the ongoing draining activity.
Developing story update (August 02, 2026, 18:37 UTC):
The Coldcard exploit’s total confirmed losses have incrementally risen to approximately $88.6 million, with the draining of compromised wallets still actively underway. The amount of stolen Bitcoin remains at 1,367 BTC.
Crucially, our sources now report a noticeable spike in exchange deposits, alongside movement from previously dormant Bitcoin wallets. This activity could signal victims attempting to move remaining funds, or potentially attackers beginning to liquidate portions of the stolen assets, which may introduce additional, albeit marginal, selling pressure into the market.
What to watch now: Monitor exchange inflows for continued selling pressure from affected users or potential liquidation by attackers.
Developing story update (August 02, 2026, 18:15 UTC):
Our latest intelligence confirms that the Coldcard hardware wallet exploit remains active, with attackers continuing to drain affected wallets as recently as one hour ago. This reinforces the ongoing nature of the security breach.
Furthermore, our sources indicate that the attackers still retain a significant portion of the 1,367 BTC stolen, suggesting the funds have not yet been fully dispersed or laundered. Traders should continue to monitor for any significant movements of these assets.
What to watch now: Monitor for further movements of the stolen BTC by the attackers and any new affected addresses.
Listen: the breakdown
Developing story: This story is still unfolding. We are tracking it and will update this article as more details are confirmed.
Market briefing: The Coldcard exploit has grown to roughly 88.6 million dollars across three waves, and frightened owners are moving coins back to exchanges. Bitcoin held near 63,246 dollars, up 0.4 percent, but the sell-side supply is building under resistance.
- Coldcard exploit losses reached 1,367 BTC, about $88.6 million, across 4,585 addresses in three waves.
- Small transfers under 10 BTC spiked exchange deposits to 7.3K BTC on Friday as owners fled self-custody.
- BTC held near $63,246 under resistance, with our accumulation zone sitting lower at $61k to $59k.
The Coldcard exploit is no longer a one-off scare. It has ballooned to roughly $88 million and the wallets keep draining. So who ends up holding the risk here?
The Coldcard exploit has stopped looking like an isolated incident. Observed losses now reach 1,367.05 BTC, worth roughly $88.6 million, spread across 4,585 wallet addresses. This did not happen in a single strike. It arrived in three distinct waves, and the draining has continued rather than stopped.
The first phase began on July 30. Since then the theft has kept expanding, which is the part that matters more than any single number. A finished hack is a loss. An ongoing one is a live wound.
The cause points to weak seed generation or a firmware flaw in certain Coldcard hardware wallets. In plain terms, the private keys that were supposed to be unguessable were not quite random enough. Attackers did not need to trick anyone. They needed only to compute what the device should have kept secret.
We already noted this week that owners rushed coins to safety after the breach. The new development is the scale and the persistence. This is now a three-wave, $88 million event that is still moving.
The structural point is uncomfortable for the industry. Self-custody was sold as the safe choice, and for most people it still is. But a flawed device turns "not your keys, not your coins" into a warning rather than a comfort. Frightened owners are reacting the obvious way. They are sending Bitcoin back to exchanges, where it feels reachable and sellable.
How a seed flaw becomes sell pressure
The transmission mechanism here runs through trust, not code. A hardware wallet exploit does not directly move the Bitcoin price. It moves behavior, and behavior moves liquidity.
When owners lose faith in cold storage, they do the human thing. They pull coins toward somewhere they can watch and act. Exchanges are that somewhere. So a security failure quietly converts dormant, self-custodied supply into active, exchange-based supply that can be sold in seconds.
The data already shows this shift. Daily exchange deposits from smaller transfers, those under 10 BTC, spiked to 7.3K BTC on Friday. Small transfers are a retail fingerprint. This is not a few whales rotating custody. It is many ordinary holders reacting to a headline.
That matters because sell-side liquidity is the raw material of a dip. More coins on exchanges means more coins that can be dumped if fear deepens. The exploit itself is contained to affected devices, but the fear is not. Fear travels faster than any patch.
There is a mild irony worth noting. The very tool bought to avoid trusting an exchange has, for some owners, sent them straight back to one. The market rarely rewards the panicked timing that follows a scare like this.
Where the supply lands on BTC and alts
Start with Bitcoin, because that is where the fear concentrates. Fresh exchange inflows add to sell-side pressure exactly when price is struggling under resistance near $63,000. That combination, extra supply into a stalling market, is how short-term dips get funded.
BTC held near $63,246 and was up 0.4 percent on the day, which tells you the reaction is orderly, not a crash. This is drift with a downward bias, not capitulation. The 7.3K BTC of small deposits is fuel sitting near the flame, not the fire itself.
Ethereum tends to follow this script with a lag. When BTC leaks lower on risk-off flows, ETH usually gives back more in percentage terms, because it carries more speculative positioning. A Bitcoin security scare is not an Ethereum story, yet ETH still pays part of the bill.
Altcoins sit at the far end of the chain. They are the highest-beta expression of whatever BTC does next. If Bitcoin dips toward its lower support, thinner alt order books tend to amplify the move, both down and, later, back up.
The honest read is that no single price target is forced by this event. It raises the odds of a controlled dip, not the certainty of one. The exploit adds supply and nerves. The market decides what to do with them.
Signals that confirm or kill the dip
Watch the exchange inflows first, because they are the cleanest signal here. If daily small-transfer deposits keep climbing past Friday's 7.3K BTC, the fear is spreading and sell-side supply is still building. That leans toward more downside.
If those inflows fade over the coming days, the scare is being absorbed. Coins arriving on exchanges do not have to be sold. Many will simply sit, and that quiet is the invalidation of the bearish case.
Next, watch how the exploit itself develops. This is still a live, three-wave event, so a clear firmware fix and a halt to new thefts would cap the fear directly. Continued draining, by contrast, keeps the story alive and keeps nervous owners reaching for the sell button.
On the chart, the $63,000 zone is the referee. If BTC keeps failing to reclaim it on weak volume, that reclaim failure confirms sellers are in control near term. Declining bullish volume on each attempt is the tell.
A decisive push back above resistance, with real volume behind it, would flip the read. It would suggest the exchange inflows were absorbed and the fear was fully priced.
Finally, keep one eye on where price actually finds buyers. A slide that stalls and holds in the lower support band means the panic supply got soaked up. That is the difference between a dip that recovers and one that keeps going.
What the exchange inflows mean for positioning
The ParadiseTeam reads this exploit as a fear catalyst, not a fundamental one. The Bitcoin network is unharmed. A batch of flawed devices and a wave of nervous owners are the actual story, and that distinction shapes how we position.
BTC was trading near $63,246, right inside the $63,000 zone we have flagged as resistance. Exchange inflows arriving into that ceiling is textbook near-term pressure. It raises the odds that price rejects here rather than breaks out, especially with bullish volume already fading on reclaim attempts.
Our bias stays patient and lower. We see higher probability of a dip toward the $61,000 to $59,000 buying area than a clean break above resistance from here. If $62,500 flips into resistance on the way down, that confirms sellers hold the short-term structure.
Here is the reframe that defines our edge. Retail is doing the reacting, sending small transfers to exchanges out of fear. That supply is exactly what patient buyers wait for. Fear moves coins from weak hands to strong ones, and a dip into $61k to $59k would be smart money's accumulation window, not a reason to panic.
Invalidation is honest and specific. A strong reclaim of $63,000 on rising volume would tell us the fear was absorbed and our lower target is off the table for now. Until then, we favor cash discipline over chasing. A tight R:R (risk-to-reward) at defined support beats forcing a trade into resistance.
Track it live: our Crypto Fear and Greed Index and the live crypto funding rates both update in real time, so you can watch this shift for yourself.
Related coverage
For exact entries, targets, and stop losses with full risk management, that is what ParadiseFamilyVIP is for. New to reading these moves? Start with our crypto trading strategies guide.
ParadiseTeam is monitoring the market situation closely, and we are taking these developments into consideration while building our trading tactics inside ParadiseFamilyVIP.
Crypto trading involves substantial risk. Prices are volatile and you can lose money. This article is educational and is not financial advice. Past performance does not guarantee future results.
