Coldcard losses have climbed above $115 million, with 1,778.58 Bitcoin swept from 8,680 addresses since July 30, based on Galaxy Research data through August 13, while most affected addresses still have no identified owner. The firm said the pattern points to flawed firmware (device operating software) shipped on March 17, 2021, at block 674,951: none of the 6,303 coins stolen in the attack waves predate that release, the same was true for 3,598 victim-dated addresses, and the earliest affected address dates to March 22, 2021, which Galaxy described as the flaw’s signature. Galaxy added that the drained addresses had been idle for a median 1,292 days, or about 3.5 years, Wave 1 accounted for $70.2 million or 61% of total losses, and reported claims still cover only 714.81 BTC from 192 people, or 40.2% of the Bitcoin taken, leaving 6,890 addresses and 1,063.76 BTC without an attached owner despite a warning from Binance Founder CZ as the sweeps accelerated.