Security tools lag, Bitcoin infrastructure continues to be attacked

Galaxy Research currently confirms that Bitcoin losses caused by the Coldcard hardware wallet vulnerability have reached 1,596 BTC (approximately US$100 million), involving three rounds of attacks and 14 smaller incidents. If a suspected fourth round of attacks is included, the total loss will rise to 2,055 BTC (approximately US$130 million), but Galaxy made it clear that it will not include the fourth round in the confirmed figures until more victims come forward.

TRM Labs independently conducted forensic analysis, and its data was approximately 1,816 BTC (approximately 116 million US dollars). This difference is due to different methods and time points and is not a contradiction. Coldcard was one of five Bitcoin infrastructure failures that occurred in the first ten days of August, bringing total losses in July to $247.4 million, making it the second-worst month of 2026. None of these attacks are new technologies, and each stems from a design assumption that has not been tested in years.

COLDARD hack lost more than US$100 million

High confidence confirmation: 1,596 BTC was stolen from approximately 7,300 addresses, involving three rounds of confirmation attacks +14 smaller incidents. If suspected (but unconfirmed) losses were included, the total would swell to US$130 million (2,000 BTC). See the tweet below for more details.

pic.twitter.com/RAl3ib67qa - Galaxy Research (@glxyresearch) August 3, 2026

Two known operators of BTCPay Server-hardware wallet company Foundation and media Citadel21-suffered lightning clearing of network node funds. The attacker obtained a "macaroon" credential file, which serves as a holder token for the Lightning Network Daemon (LND): whoever holds the file can control the node without further login.

Bybit is separately suing North Korea, its General Reconnaissance Administration and the Lazarus Group in connection with a $1.5 billion 2025 hacking attack, and has now obtained a preliminary federal court injunction to freeze identified assets (see below for more information on the recovery data). The crowd-sourced AI-driven security audit led by developer Calle has recorded 4,962 findings in 390 Bitcoin projects. A review article on the "audited" label of cryptocurrencies takes the Bybit signature interface forgery incident in 2025 as an example to illustrate problems that standard audits failed to discover. Small processing service provider Coinsbuy lost $7.9 million on Ethereum and TRON, and attackers have begun moving funds to Monero.

After taking into account other July activity, the total monthly loss reached US$247.4 million, the second worst month in 2026, with Coldcard holding about half.

Three different vulnerabilities, a design habit that no one rechecks

These are not the same loopholes. Coldcard's failure stems from a firmware build error in March 2021: a configuration flag designed to force devices to use hardware random number generators was never actually executed by the underlying library, so seed generation fell back to software RNG for seeds based on chip serial numbers and timer registers, both of which are not secret and no one has pointed out the problem for five years. Coinkite's fix closes the vulnerability for new wallets, but cannot retroactively protect keys that have been generated under the flawed process; the security of these funds depends only on how quickly their owners move them. BTCPay's failures fall into a completely different category: credential management vulnerabilities. LND's macaroon files can be obtained through BTCPay's own publicly exposed remote access endpoints. This design was not re-examined until nodes began to be emptied. The Bybit case cited in the comments is different: the attacker forged the signature interface so that the human eye reviewer could see a target address, while another valid transaction was actually executed. The underlying contract code passed all audits, but the manual review steps failed.

It is not the mechanism itself that connects these events, but that each event stems from a design assumption that no one has reason to re-test until the problem is forced to expose. Coinkite CEO Rodolfo Novak said why the Coldcard vulnerability was finally discovered five years later: "AI auxiliary code review may be the reason why it was finally discovered."

This fits with the other half of the story: Calle's audit used AI-assisted scanning, and of the 4,962 findings, 720 were rated as severe or high-risk. Whether it is an attacker or a defender, the tools that now discover these vulnerabilities are discovering vulnerabilities that already exist. Charles Guillemet, chief technology officer at Ledger, publicly commented days after the vulnerability was exposed: "We take this as a serious reminder that the entire security model of hardware wallets relies on randomness."... "Defense must be maintained at the same speed as the tool that originally discovered the vulnerability."

This is a competitor who publicly reached the same conclusion without questioning.

90% were not transferred, 3% were recovered, 14.5% were serious: What these percentages actually mean

Incident: Coldcard; Title number: Up to $130 million stolen (2,055 BTC); More important numbers: 90% of stolen bitcoins were not transferred

Incident: Bybit; Title number: US$1.5 billion stolen (2025); More important numbers: Only US$48.4 million recovered + US$30.5 million frozen (approximately 3%);90.2% still untraceable

Incident: AI security audit; Title Numbers: 4,962 findings, 390 items; more important numbers: 720 items were assessed as serious/high-risk (14.5% severity rate)

Incident: Coinsbuy; Title number: $7.9 million stolen; More important numbers: Six-figure amounts were frozen through ChangeNOW before full money laundering

According to Galaxy Research, 90% of bitcoins stolen from Coldcard wallets have never been transferred since leaving the victim's wallet. This detail is important to tracking, but it also means that the exploit is not over, it is just suspended. On Bybit's side, the important figure is not the $1.5 billion in the title, but the $48.4 million actually recovered and the $30.5 million frozen on more than 28 exchanges: about 3% of the total, and 18 months after the incident, despite winning a court decision, 90.2% of the stolen assets were still untraceable as of the June filing. Calle's audit of 4,962 findings included 720 critical or high-risk ratings, with a severity rate of 14.5%, which is similar to Galaxy's own methodological notes on the fourth round of attacks: Both tasks are ahead of what they can fully confirm.

Questions about "systematic" interpretations

Not all affected parties believe this constitutes a pattern. Coinsbuy's statement about its vulnerability was blunt: "Current investigations indicate that the breach was an isolated incident and not evidence of a deeper systemic vulnerability in Coinsbuy's infrastructure." Based on existing facts, the Coinsbuy incident is an independent multi-chain wallet intrusion, related to Coldcard's entropy vulnerability or BTCPay's credential design without confirmation technology. This article's interpretation of "systemic stress" is based on the infrastructure layer sharing a failure pattern (stale, untested assumptions) rather than every incident sharing the same cause. The $247.4 million in July reflected only one month of hacking losses.

Fact correction: Calle and Rob Hamilton

The original information summary for this article attributed a quote to "the founder of the AI security campaign":"As a patriotic American, it hurts me to do this, but I will revert to the Chinese open source model." The quote belonged to Rob Hamilton, founder of a group called Bitcoin Red Team, after OpenAI restricted his access to Trust & Cyber tools. The quote did not belong to Calle, who led the audit of 4,962 findings/390 projects. No source in this report states whether Hamilton's Bitcoin Red Team and Calle's audits were the same task (two names) or two different initiatives. The two should not be merged into one main line until they are determined.

Timeline

Date: March 2021; Event: Unmarked firmware build errors introduced in Coldcard software

Date: July 30, 2026; Event: First round of confirmed Coldcard theft began

Date: August 3 to 7, 2026; Event: Second to Fourth rounds; Galaxy Research's estimate rose from approximately US$70 million to US$130 million

Date: August 4, 2026; Event: Ledger Chief Technology Officer Charles Guillemet publicly responded

Date: August 7, 2026; Event: Bybit obtains preliminary injunction against North Korea and Lazarus Group

Date: August 9, 2026; Event: BTCPay Server restricts remote lightning network access; patch released

Date: August 10, 2026; Event: Coinsbuy disclosed US$7.9 million in capital loss

What can confirm or overturn this interpretation

Galaxy Research's complete methodology for a fourth round of attacks, once the victim is identified bridges the gap between suspected and confirmed losses.

Hardware wallet manufacturers other than Coinkite and Ledger answer directly: Is this a design risk for the entire category, or is it just a question for Coldcard?

The complete monthly hacking dataset behind the $247.4 million loss in July and compared to previous months.

FAQs

Is my Coldcard wallet still at risk after a firmware update?

Only if your key was generated before repair. Coinkite's update prevents defective entropy fallback in new wallets, but does not retroactively protect keys generated under the old process. Please refer to Coinkite's own official recommendations for device-specific guidance rather than treating this article as a personalized explanation.

How much money was actually recovered in these hacking attacks?

Very little relative to the loss. Bybit's court documents showed $48.4 million was recovered and $30.5 million was frozen, while losses were $1.5 billion, or about 3%. Coinsbuy froze a six-figure amount of its $7.9 million loss. 90% of the bitcoins associated with Coldcard were not transferred at all.

Is the statement of "systematic" in this article confirmed by others?

No. This is an analytical interpretation of this article itself. Coinsbuy has clearly questioned the systematic framework description of its own events, and the $247.4 million in July is only one month's data and has not yet formed a multi-month trend.

Who actually led Bitcoin's AI-driven security audit?

The audit of 4,962 findings and 390 projects was led by the pseudonym developer Calle. Another figure, Rob Hamilton, of a group called Bitcoin Red Team, has publicly talked about losing access to AI tools; no source in this report determines whether the two jobs are the same or different.