The revelation that attackers may have systematically drained Bitcoin addresses produced by Coldcard hardware wallets has put a harsh spotlight on cold storage assumptions. Galaxy Research’s on-chain work, detailed in the original report, identified three distinct waves siphoning a combined 1,367.05 BTC—valued around $88.6 million—across 4,585 addresses. The thefts span two patterns that look like a single operator, and a third that suggests either an upgraded method or a separate offender targeting the same vulnerable key space.