Galaxy Research Traces 1596 Stolen Bitcoin to Major Blockchain Sweeps

Galaxy Research has identified the theft of 1,596 BTC from Coldcard users, an attack that could reach a total value of 130 million USD. The security firm linked the losses to three large-scale “sweeps” and 14 smaller incidents by analyzing blockchain patterns on August 4, 2026.

Blockchain Analysis of Coldcard BTC Losses

The identified loss of 1,596 BTC resulted from a combination of coordinated movements and isolated thefts. According to Galaxy Research, the attackers executed three primary “sweeps”—large, systemic drains of funds—alongside 14 minor incidents. These events were connected through specific patterns observed on the blockchain, which allowed researchers to link the disparate thefts to a single campaign targeting Coldcard hardware wallet users.

The total financial impact of these confirmed thefts is estimated to potentially reach 130 million USD, depending on the market valuation of the stolen Bitcoin. The use of blockchain forensics allowed Galaxy Research to trace the movement of funds from the compromised wallets to the attackers’ addresses.

Coldcard Security and Hardware Wallet Risks

Coldcard is a hardware wallet designed for “cold storage,” which means it keeps private keys offline to prevent remote hacking attempts. The theft of over 1,500 BTC suggests a breach of the security perimeter that these devices are intended to provide. While the specific technical vector of the attack—whether via seed phrase compromise, supply chain interference, or a software vulnerability—remains under investigation, the scale of the sweep indicates a highly organized effort.

In typical blockchain “sweeps,” attackers identify a pattern or a vulnerability that affects a group of users and rapidly move the funds before the owners can react. The 14 smaller incidents identified by Galaxy Research likely served as precursors or secondary targets compared to the three major sweeps that constituted the bulk of the 1,596 BTC loss.