Bitcoin Infrastructure Under Sustained Attack as Security Tools Fall Behind

MakeCryippreferred on

Galaxy Research now puts confirmed Bitcoin losses from the Coldcard hardware-wallet exploit at 1,596 BTC, roughly $100 million, across three attack waves and 14 smaller incidents. A suspected fourth wave would push the total to 2,055 BTC, or about $130 million, though Galaxy is explicit that it’s excluding that fourth wave from its confirmed count until more victims come forward. TRM Labs, running its own independent forensics, puts the number closer to $116 million and 1,816 BTC, a different figure reflecting different methodology and timing, not a contradiction. Coldcard is one of five Bitcoin-infrastructure failures in the first ten days of August that add up to $247.4 million for July, the second-worst month of 2026, and none of them were new attack techniques: each traces to a design assumption nobody had re-tested in years.

BTCPay Server had Lightning nodes drained at two named operators, the hardware-wallet company Foundation and the publication Citadel21, after attackers obtained the “macaroon” credential files that function as bearer tokens for Lightning Network Daemon access: whoever holds the file controls the node, no further login required. Bybit is separately suing North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the $1.5 billion 2025 hack, and has now secured a federal court’s preliminary injunction freezing identified assets (recovery numbers are detailed below). A crowdsourced AI-driven security audit led by the developer Calle has logged 4,962 findings across 390 Bitcoin projects. A published critique of crypto “audited” badges uses a specific, separate failure, the 2025 Bybit signing-interface spoof, as its working example of what standard audits don’t catch. Coinsbuy, a smaller processing service, lost $7.9 million across Ethereum and TRON, with the attacker already moving funds into Monero.

Add it up with the rest of July’s activity and the monthly total hit $247.4 million, the second-worst month of 2026, with Coldcard alone accounting for roughly half.

Three Different Bugs, One Design Habit Nobody Re-Checked

These aren’t the same bug. Coldcard’s failure traces to a March 2021 firmware build error: a configuration flag meant to force use of the device’s hardware random-number generator was never actually enforced by the supporting library, so seed generation fell back to a software RNG seeded by the chip’s serial number and timer registers, neither of which is secret, and neither of which anyone flagged for five years. Coinkite’s fix closes that gap for new wallets. It does not retroactively protect keys already generated under the flawed process; those funds remain only as safe as however quickly their owners moved them. BTCPay’s failure is a different category entirely: a credential-management gap, where LND’s macaroon files could be reached through BTCPay’s own publicly exposed remote-access endpoints, a design nobody had revisited until nodes started getting drained. The Bybit case cited in that critique is different again: attackers spoofed a signing interface so a human approver saw one destination address while a different, valid transaction executed. The underlying contract code passed every audit; the human-verification step didn’t.

What connects them isn’t the mechanism. It’s that each was a design assumption nobody had reason to re-test until something forced the issue. Coinkite CEO Rodolfo Novak’s own read on how the Coldcard bug finally surfaced after five years:

“AI-assisted code review may be why it was finally found.”

It lines up with the other half of this story: Calle’s audit used AI-assisted scanning for the bulk of its 4,962 findings, 720 of them critical or high severity. Whatever is finding these gaps now, attacker or defender, is finding gaps that were always there. Ledger CTO Charles Guillemet offered his own read publicly, days after the exploit:

“We’re treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness.” … “Defense has to move at the same speed” as whatever found the bug in the first place.

That’s a competitor drawing the same conclusion, in public, before being asked.

90% Unmoved, 3% Recovered, 14.5% Critical: What the Percentages Actually Say

Ninety percent of the Bitcoin stolen from Coldcard wallets, per Galaxy Research, hasn’t moved since it left victim wallets. That detail matters for tracing, but it also means the exploit isn’t over, it’s paused. On the Bybit side, the number that matters isn’t the headline $1.5 billion. It’s the $48.4 million actually recovered against it and $30.5 million frozen across 28-plus exchanges: roughly 3% of the total, 18 months after the fact and despite a court win, with 90.2% of the stolen assets still untraceable as of the June filing. The 4,962 findings from Calle’s audit include 720 rated critical or high, a 14.5% severity rate that sits alongside Galaxy’s own Wave 4 methodology note: both efforts are running ahead of what they can fully confirm.

Where the “Systemic” Read Gets Pushed Back On

Not every affected party agrees this adds up to a pattern. Coinsbuy’s own statement on its breach is direct:

“Current investigations suggest the breach was an isolated incident rather than evidence of some deeper systemic vulnerability within Coinsbuy’s infrastructure.”

Coinsbuy’s incident, on the facts available, is a separate multi-chain wallet compromise with no confirmed technical link to Coldcard’s entropy bug or BTCPay’s credential design. The “systemic strain” read here rests on the infrastructure layer sharing a pattern of failure (old, unexamined assumptions), not on every incident sharing a cause. July’s $247.4 million reflects one month of hack losses.

Correcting the Record: Calle vs. Rob Hamilton

This story’s original intake brief attributed a quote to “the AI security campaign’s founder”:

“It absolutely guts me as a patriotic American to have to do this, but I will be going back to using Chinese open source models.”

That quote belongs to Rob Hamilton, founder of a group called Bitcoin Red Team, after OpenAI restricted his access to its Trust & Cyber tooling. It does not belong to Calle, who leads the 4,962-findings/390-projects audit. No source in this reporting states whether Hamilton’s Bitcoin Red Team and Calle’s audit are the same effort under two names or two distinct initiatives. Until that’s established, the two shouldn’t be merged into one throughline.

Timeline

What Would Confirm This Read, or Break It

• Galaxy Research’s full Wave 4 methodology, once victim confirmation closes the gap between suspected and confirmed losses.
• A direct answer from a hardware-wallet maker beyond Coinkite and Ledger, on whether this is a category-wide design risk or a Coldcard-specific one.
• The full monthly hack-loss dataset behind the $247.4 million July figure, compared against the prior several months.

FAQ

Is my Coldcard wallet still at risk after the firmware update?
Only if your keys were generated before the fix. Coinkite’s update prevents new wallets from hitting the flawed entropy fallback, but it can’t retroactively re-secure keys already generated under the old process. Consult Coinkite’s own advisory for device-specific guidance rather than treating this article as personalized instructions.

How much money has actually been recovered from these hacks?
Very little, relative to the losses. Bybit’s court filings show $48.4 million recovered and $30.5 million frozen against $1.5 billion stolen, roughly 3%. Coinsbuy froze a six-figure sum of its $7.9 million loss. Ninety percent of Coldcard-linked Bitcoin hasn’t moved at all.

Is the “systemic” claim in this piece confirmed by anyone else?
No. It’s this piece’s own analytical read. Coinsbuy has explicitly disputed a systemic framing for its own incident, and July’s $247.4 million is one month of data, not yet a multi-month trend.

Who actually leads Bitcoin’s AI-driven security audit effort?
The 4,962-findings, 390-project audit is led by the pseudonymous developer Calle. A separate figure, Rob Hamilton of a group called Bitcoin Red Team, has spoken publicly about losing AI-tool access; whether the two efforts are the same or distinct hasn’t been established by any source in this reporting.