# Coldcard weak-seed sweeps hit 1,367 BTC in 3 waves > Galaxy Research now tracks ~1,367 BTC (~$89M) drained from 4,585 addresses across three Coldcard weak-seed waves, with wave three still ongoing after the July 30 disclosure. - **Source:** https://ptycoin.com/en/posts/2026-08-03-coldcard-third-wave-1367-btc-89m/ - **Published:** 2026-08-03 - **Category:** News - **Author:** Mateo - **Tags:** bitcoin, security, self-custody, wallets - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-08-03-coldcard-third-wave-1367-btc-89m/) --- **Galaxy Research** raised its observed total for the [Coldcard weak-entropy sweeps](https://x.com/glxyresearch/status/2083623500183421043) to **1,367.05 bitcoin** (about **$88.6–89 million**) across **4,585** addresses after flagging a third wave that moved roughly **208 BTC** from **1,912** addresses. That is more than double the ~594 BTC first-wave figure [PTYcoin covered](/en/posts/2026-07-31-coldcard-mk3-seed-entropy-warning-594-btc/) when Coinkite published its initial advisory on **30 July**. [CoinDesk](https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million) and [The Hacker News](https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html) matched the same combined totals. Galaxy stresses the numbers come from on-chain clustering, not a cryptographic re-derivation of every victim seed: the firm has not brute-forced every address to prove Coldcard entropy was the cause. ## How the three waves look Galaxy’s public tracking, summarized by CoinDesk, breaks the activity into three clusters between **30 July** and the start of **August**: | Wave | Rough scale | On-chain shape (Galaxy / CoinDesk) | | --- | --- | --- | | 1 (30 July) | ~1,083 BTC from 1,196 addresses in ~41 minutes | One victim per spend; shared collector addresses; plain single-key outputs | | 2 (31 July) | ~76 BTC from 1,478 addresses over ~3h 42m; running total ~1,159 BTC / 2,673 addresses | ~0.05 BTC average — the smallest of the three; same collector pattern as wave 1 (Galaxy’s working assumption) | | 3 | ~208 BTC from 1,912 addresses | ~0.1 BTC average; unique destinations; P2WSH vaults; ~6 victims per batch | Wave three is the new operational story. Instead of dumping many victims into a handful of easy-to-tag collector addresses, it sends each drained wallet to its own destination and parks coins in [pay-to-witness-script-hash](https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million) (P2WSH) outputs, which can hide multisig or timelock scripts until the first spend. Galaxy is monitoring 293 of those unspent P2WSH vaults; the first spends will reveal the scripts underneath. Galaxy says it is confident each *wave* is one operator internally, and it will **not** formally link all three to the same actor. Stolen balances from the mapped endpoints remain largely unspent on-chain. On **2 August** the firm [posted](https://x.com/glxyresearch/status/2083705254172864861) that the exploit is **ongoing**, that it has reported about **600** suspected attacker-held addresses to U.S. investigators and compliance teams, and that victims who share addresses and TXIDs (without personal data) are still helping map new clusters. ## What broke, and what Coinkite has fixed since The root cause is unchanged from the first advisory: a March 2021 firmware path that sent seed generation through a weak software PRNG instead of the chip’s hardware RNG, shrinking effective entropy far below the 128-bit BIP-39 target. Attackers who can enumerate that reduced keyspace rebuild candidate seeds offline and match funded addresses on the public chain. No one needs physical access to a Coldcard. [Coinkite’s advisory](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/), updated **1 August 2026**, now lists fixed firmware for every affected track: - **Mk2 / Mk3:** [4.2.0 or later](https://coldcard.com/downloads/mk3) - **Mk4 / Mk5 standard:** [5.6.0+](https://coldcard.com/downloads/mk); Edge **6.6.0X+** - **Q standard:** [1.5.0Q+](https://coldcard.com/downloads/q1); Edge **6.6.0QX+** A firmware upgrade **does not** repair a seed already written years ago. You generate a *new* seed on fixed firmware and migrate. Coinkite still treats seeds built with **≥50** fair, private dice rolls (via **Add Dice Rolls**) as outside this RNG failure alone, and still wants passphrase users to migrate as soon as practical. TAPSIGNER, OPENDIME, and SATSCARD stay out of scope. [Block’s engineering write-up](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware) explains the integration mistake that bound production builds to MicroPython’s software fallback; Coinkite’s own [entropy technical backgrounder](https://blog.coinkite.com/entropy-technical-backgrounder/) puts Mk3-class exposure near ~40 bits and newer models near ~72 bits until the hotfix builds. ## Who still needs to move The urgent cohort is the same as last week, only larger in the on-chain sample: **single-signature** wallets whose seed was device-generated on vulnerable firmware, without enough independent dice entropy and without a strong BIP-39 passphrase. Multisig only helps when the quorum is not built entirely from weak device seeds. Galaxy notes the value is concentrated in larger balances while the address count is dominated by sub-1 BTC wallets (the shape of long-term self-custody, not corporate treasuries). If you already migrated after the **30–31 July** posts, you do not need a second migration for this news alone. If you still hold funds on a Coldcard-generated single-sig seed from the vulnerable window, treat the third wave as a reason to finish the move carefully this week: 1. Install the fixed build for your model from Coinkite’s official pages, then confirm the version on-device. 2. Create a **new** seed; verify the backup and a receive address on the device screen. 3. Test-send a small amount; only then move the rest. 4. Keep the old backup until the new wallet is proven. Mk2/Mk3 owners who only have that device can now complete a full migration on **4.2.0** without buying newer hardware. Coinkite’s one-device steps (verify old backup → new seed → test → residual move) remain the safer path than a rushed bulk send. ## Takeaway The story that opened with a 25–41 minute first sweep is now a multi-day, multi-wave campaign that researchers still mark as active. Hardware wallets remove exchange counterparty risk; they do not remove firmware and entropy risk, and offline storage only works if the seed was generated with real randomness. For holders who treat a Coldcard as a multi-year vault, the practical answer is still boring: confirm which model and firmware created each seed, treat weak-entropy single-sig wallets as compromised for planning, upgrade before minting a replacement key, and verify every address on the device screen. This is a security incident report, not investment advice. If coins sit on an affected seed, follow Coinkite’s migration checklist before the next sweep finds them. --- ## Keep reading - [How to plan gas so your stablecoins stay spendable](https://ptycoin.com/en/posts/2026-07-28-gas-planning-native-fees-stablecoins/index.md): USDT can land in a wallet and still be unspendable. You need the chain's own coin for fees. This guide shows how to keep TRX, ETH, SOL, and similar gas ready before you need it. - [How to pick the right network for USDT and USDC](https://ptycoin.com/en/posts/2026-07-21-pick-right-network-usdt-usdc/index.md): USDT and USDC exist on many chains. Wrong-network sends are a top permanent-loss risk. Use this checklist to match asset, network, fees, and wallet support before you transfer. - [How to receive crypto safely into a self-custody wallet](https://ptycoin.com/en/posts/2026-07-14-receive-crypto-safely-self-custody/index.md): Receiving is safer than sending, but the wrong network or a shared address still loses funds. This checklist shows how to generate, verify, and share a receive address correctly. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-08-03-coldcard-third-wave-1367-btc-89m/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/