Galaxy Research said thefts tied to flawed COLDCARD seed generation have exceeded $115 million based on bitcoin prices at the time of theft, with 1,778.58 BTC swept from 8,680 addresses since late July and about 714.8 BTC directly reported by 192 victims. Galaxy said it has since spoken with more than 200 victims and warned total losses could exceed $130 million. The attacks exploited a 2021 firmware bug in Coinkite’s hardware wallets that made some recovery seeds predictable enough for attackers to reconstruct private keys and drain funds, despite the devices being kept offline.