Galaxy's updated accounting: 1,596 BTC from ~7,300 addresses

stackernews-galaxy-updated-total

https://stacker.news/items/1539646

Organisation

Stacker News

Evidence role

Reporting

Published

2026-08-04

Source changes

0

Detected differences

0

Unreviewed

0

Copies held

1

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 15 Aug 2026, 12:26 UTC.

1. Earliest copy held Current
   seen 4 Aug 2026, 03:29 UTC · Captured here 3,870 chars
   Extracted text as captured

   {
     "data": {
       "item": {
         "comments": {
           "comments": [
             {
               "createdAt": "2026-08-04T01:55:55.346Z",
               "text": "Pales in comparison to Mt. Gox still, right?\n\nAlthough, dollar value wise, I'm not sure.",
               "user": {
                 "name": "SimpleStacker"
               }
             },
             {
               "createdAt": "2026-08-04T00:01:00.494Z",
               "text": "https://twiiit.com/glxyresearch/status/2084411904924045370",
               "user": {
                 "name": "nitter"
               }
             }
           ]
         },
         "createdAt": "2026-08-04T00:00:15.195Z",
         "text": "*Galaxy Digital is out with an update on coins they think are part of those stolen due yo faulty entropy from Coldcards:\n\n--- \n\nLOSSES FROM COLDCARD HACK EXCEED $100M \n\nHigh confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents. \n\nIf we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).\n\nMore in the thread below 👇\n\n![](https://m.stacker.news/150725)\n\nThis graphic shows every event we've identified, positioned by when it began and sized by how many addresses it drained. The three mass waves dominate the picture; the lettered footprints of are the smaller markers.\n\nWave 4 remains unconfirmed by any victim, though we suspect it's real with medium-high confidence.\n\n![](https://m.stacker.news/150727)\n\nWave 1 was first observed by engineers at [@blocks](https://x.com/blocks), but we have fully confirmed it based on victim reports.\n\nWe discovered Waves 2 and 3 based on victim reports, and continue to receive multiple victim confirmations. \n\nMost victims appear in only one wave, though some appear in two.\n\n![](https://m.stacker.news/150728)\n\nIn total, 73 individual victims have reached out to [@intangiblecoins](https://x.com/intangiblecoins) for help tracing their coins. With help from victim reports, we have identified 14 additional footprints. These could be many different attackers individually exploiting the now-known vulnerability.\n\n![](https://m.stacker.news/150729)\n\nWhile we have also identified a potential Wave 4, we have yet to receive specific victim confirmation of inclusion in this wave. Including it would bring the total to 2055 BTC ($130m). \n\nWe believe with medium-high confidence that Wave 4 is substantially comprised of an attacker, but we have not promoted it into our top-line numbers because we lack sufficient victim confirmation.\n\n![](https://m.stacker.news/150730)\n\nWe have been providing confirmed attacker and victim addresses to US federal law enforcement authorities, crypto exchanges, crypto compliance & cyber investigation companies and groups, and other relevant parties. \n\n90% of stolen coins have not moved. 100% of coins in Waves 1, 2, and 3 have not moved. It is essential that we continue to identify additional attacker addresses, especially as new, opportunistic attackers emerge, so that we can report their addresses to authorities.\n\nThe attack is ONGOING. If you are using a Coldcard and unsure whether it's safe, migrate your funds to a safe address at a custodian/exchange or a fresh seed.\n\nIf you are a victim, please DM [@intangiblecoins](https://x.com/intangiblecoins) and share your drained addresses and attacker TXIDs. He can help you with tracing and providing information that will be useful to reporting your loss to authorities.\n\nStay safe and stay positive. There are still hopes for recovery. Thanks to many of the great people working behind the scenes to help victims, identify attackers, audit and harden codebases, and help people keep their coins safe. You know who you are. 🧡",
         "title": "1,596 BTC has been stolen from ~7300 addresses - Galaxy Digital",
         "user": {
           "name": "Scoresby"
         }
       }
     }
   }