Coldcard Hack Update: How Canada Faces the Heaviest Bitcoin Losses?
Bhumika Baghel
Coldcard Hack Update: Total Losses Reach $130M, Canada Most Affected
Chainalysis has published new data on the Coldcard hack update, and Canada tops the list of affected regions. Bitcoin holders in Canada carry 25% of the losses tied to this ongoing Coldcard exploit, based on wallet data reviewed by the firm.
As per recent findings, Canada losses now stand as the largest single share tracked so far.
At the same time, a separate report from Galaxy Research estimates that total $BTC losses from this 2026 Bitcoin cold storage hack at more than $130 million.
Coldcard Hack Update: Inside the Chainalysis BTC Theft Tracking
What the Chainalysis data highlights:
Canada holds the single largest share, at 25% of attributable losses
Australia ranks among the next major regions hit by this Bitcoin cold storage hack
The United States shows a significant share of victim fund inflows tied to the exploit
Thailand also appears as a major affected region on the firm's attribution map
Community members have questioned how far geo-attribution can stretch, and Chainalysis itself labels the figures a ceiling rather than a certainty.
Chainalysis built its Canada figure using a two-step process. On-chain clustering groups Bitcoin addresses that spend together and treats them as one owner. Off-chain evidence then links those clusters to real locations through known exchange accounts.
The firm calls its map a maximum possible attribution, not a confirmed count. Analysts pulled this data from wallets tied to the Coldcard vulnerability, a flaw that let multiple attackers pull private keys from weak seed data.
Galaxy Research Confirms Rising Coldcard BTC Drain Totals Each Day
The Galaxy Research Coldcard dataset shows steady growth in stolen funds. Confirmed losses sit near 1,596 BTC drained from about 7,300 addresses, spread across three major attack waves plus 14 smaller incidents.
A fourth wave remains under review. If confirmed, the Bitcoin drain could reach 2,055 BTC, worth close to $130 million.
Current scale according to Galaxy Research:
Confirmed losses: roughly 1,596 BTC drained from about 7,300 addresses
Attack pattern: three major attack waves plus 14 smaller incidents
Confirmed value: over $100 million in stolen Bitcoin
Suspected Wave 4: still under review, pending full victim confirmation
Potential total: up to 2,055 BTC, worth close to $130 million if confirmed
Average dormancy: 3.18 years, showing most victims were long-term holders
At least 15 separate attackers show up in the data, each tagged by a distinct on-chain pattern. About 90% of the stolen coins still sit untouched in attacker wallets, a detail that may aid future recovery work.
Early waves of this Coldcard BTC drain looked coordinated. Later activity reads more like a free-for-all, with smaller opportunistic attackers racing to reach remaining vulnerable wallets before anyone else does.
Coinkite Security Advisory: Firmware Fix and Migration Steps
Coinkite Coldcard has moved fast since the flaw came to light. The firm issued a direct warning through its official channel, calling the situation urgent.
Coinkite security advisory steps for owners:
Check the advisory notice that matches the exact device model
Install the new firmware release before anything else
Generate a brand new seed on the patched firmware
Move funds out of any wallet built on the old seed
Share drained addresses with researchers to help map remaining attackers
The root cause traces back to March 2021. Firmware from that period used a software random number generator instead of the intended hardware source, cutting entropy to about 40 bits on Mk2 and Mk3 units.
The Coldcard Mk4 seed exploit touched newer models too, with entropy measuring closer to 72 bits, still short of the expected 128.
Coinkite has pulled remaining vulnerable inventory from circulation and posted a full technical breakdown of the entropy flaw.
Industry Voices Weigh In on Bitcoin Self-Custody Risk After the Attack
Binance co-founder Changpeng Zhao addressed the wider custody debate this week. He pointed to a 2025 River report showing 1.57 million BTC lost through self-custody against 1.51 million BTC lost on exchanges.
Zhao noted that exchange hacks get tracked quickly, while losses tied to Bitcoin self-custody risk often go unreported for years. Binance has reimbursed users after past exchange incidents, he said, and a mixed approach to custody may suit most holders better than relying on one method alone.
His comments followed Galaxy Research's newest Coldcard hack update, which pushed the total past the $100 million mark toward $130 million.
What Comes Next as the Coldcard Hack Update Investigation Continues
This ongoing drain shows no clear end date yet. Law enforcement teams now hold hundreds of flagged attacker addresses, shared directly by Galaxy Research with federal investigators, exchanges, and cyber units.
That cooperation could shape how much stolen Bitcoin ever returns to its original owners. Every wallet built on old firmware stays exposed until its owner finishes the migration steps in the official advisory, since firmware fixes only protect new seeds going forward.
This Bitcoin hardware wallet hack stands as a plain reminder: cold storage still carries risk when a hidden flaw sits inside the code for years before anyone finds it.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Crypto markets carry significant risk. Always do your own research before making any investment decisions.
