Coldcard: the safest place to keep bitcoin just lost $7.7 million
A hardware wallet is a small device you keep offline so nobody can reach your coins over the internet. Someone reached them anyway — and has now emptied the 11 biggest ones.
The idea behind a device like Coldcard is simple, and it is the advice every experienced bitcoin holder gives beginners: don't leave your coins on an exchange, put them on a gadget that never touches the internet. Cold storage. Offline. Yours. That is the whole promise.
The attacker behind the third wave of Coldcard thefts has moved $7.7 million in bitcoin, according to Galaxy Research, and has now drained the 11 largest vaults tied to that wave. Not the small ones. The biggest ones, in order.
Here is the part that should make anyone stop. The standard safety ladder in crypto goes like this: worst is an exchange, better is a phone app, best is a hardware wallet sitting in a drawer. Every guide, every friend who got in early, every thread says the same. The third wave of Coldcard thefts hit the top rung of that ladder — and the largest holders on it went first.
Cold storage is not a magic word. It is a device, and a device can be reached.
Notice the pattern in what Galaxy Research describes: the 11 largest vaults, all drained. That is not someone stumbling into random wallets. That is someone who could see how much was in each one and worked down the list from the top. Whoever this is knew where the money was before touching it. We don't know how they got in — the summary we have doesn't say, and we're not going to guess.
For most people reading this, the practical takeaway isn't about $7.7 million. It's that "I moved it off the exchange, so I'm fine" is a sentence worth retiring. Offline storage removes one kind of risk. It does not remove all of them, and the people with the most on the line found that out first.
Anyone who bought a hardware wallet because a friend told them it was the responsible thing to do — including the person with a couple of thousand in bitcoin sitting on a device in a sock drawer, who assumed the topic was closed the day they set it up. Also the twenty-somethings for whom crypto is the first money they ever saved on their own, with no bank, no adviser and nobody to call when it disappears: the security advice they inherited from older holders just took a visible hit. And the biggest holders here weren't careless — they were the ones following best practice, and they were emptied first.
The number to watch is the count. Galaxy Research says the 11 largest vaults tied to the third wave are now drained — if that figure grows, the attacker is still working, and if it stops, the wave is over. Beyond that: there is no announced investigation, no named authority and no timeline in what we have. A third wave implies there were two before it. Whether there is a fourth, nobody has said.
They went biggest first. That means the list existed before the theft did. Somewhere, somehow, the sizes of those vaults were readable to a stranger. If your own holdings are sitting on a device right now, the question isn't whether it's offline. It's who else knows what's on it.
Sources: CoinDesk, 7 September 2026 — "Coldcard hacker moves $7.7 million in BTC, 45% of bitcoin stolen in third attack wave," citing Galaxy Research.
Кража биткоина из «холодных» кошельков Coldcard показывает, что даже офлайн-хранение — не гарантия: злоумышленник уже вывел 7,7 млн долларов и опустошил 11 крупнейших пострадавших хранилищ.
Written by THE TELL’s AI newsroom. how we work · corrections