COLDCARD LOSSES HIT $112M — GALAXY RESEARCH CALLS THE MAXIMALIST-PURITY ERA OVER

Galaxy Research has been in direct contact with 190 victims. High-confidence totals: 1,778.84 BTC ($112.7M) stolen from over 8,600 addresses. Add unconfirmed Wave 4 candidates and other medium-confidence footprints and the loss climbs to 2,417.35 BTC ($153M). The attackers — there were multiple — ceased new activity after August 6, either because vulnerable users migrated or because most vulnerable funds have already been drained.

The tape math. Of the 1,778 BTC stolen, 1,531 BTC sits unmoved in attacker-controlled addresses. About 246 BTC has moved — 65% into Coinjoin mixing, 35% through peel-chains or onwards on-chain. A small trace has hit centralized exchanges or bridges. Galaxy has handed attacker-address lists to exchanges, compliance firms, and law enforcement in hopes of freezing what surfaces at custodians.

The Maximalist read. Thorn's take is the important thing. The Coldcard victim cohort is not sloppy retail. It is the most philosophically-aligned Bitcoiners — long-term savers who believed in self-custody cold storage without an intermediary. The failure did not come from bridging to DeFi or chasing yield. It came from trusting a hardware wallet that was widely promoted by Bitcoin maximalists as the most security-conscious option in the market. That failure strikes at the core of the maximalist-influencer intelligentsia's multi-year educational and promotional efforts. The era of Bitcoin maximalist purity — the register that admonishes non-self-custodians and venerates influencer-personalities above open-source developers — is very likely coming to an end in mainstream Bitcoin culture.

The winners. Multi-sig custody. Not one theft transaction stole funds from a multi-sig setup. Collaborative multi-sig services — Casa, Unchained, Nunchuk, Anchorwatch, Liana — have seen surge inflows. Casa reports "massive inbound" and "substantial amounts of BTC" moving into Casa multi-sig vaults. Anchorwatch reports the biggest single week of inflows in the company's history. Unchained: "a meaningful surge in interested from longtime self-custody bitcoiners who want to distribute that risk without giving control." The sovereignty stack survives the pivot. It just gets more redundant.

The pivot. Thorn's closer is worth reading directly: "The era of contributing to Bitcoin and converting people into bitcoiners solely through philosophical explanations, memetic platitudes, and, frankly, shitposting, is over. Bitcoiners need to do more: audit more code, educate more clearly and effectively, and be less judgmental of newcomers who may not feel technologically capable of securing their own coins." This is the same pattern this week's tape has been telling: MSCI Round Two attacks the wrapper trade at the passive-flow layer, Trezor's shipping-partner breach exposes the supply-chain PII surface, Coldcard exposes the code-audit-vs-influencer-promotion surface. The sovereignty stack has multiple attack surfaces. All of them require operator-grade discipline.

What operators do now. If funds still sit on a single-signature Coldcard-generated seed from the 2021+ firmware, move them today. Galaxy's advisory is unambiguous. For the deeper pivot: audit more code, distribute risk across multi-sig, choose infrastructure providers who welcome open-source scrutiny instead of ostracizing it. The Bitcoin Red Team — Rob Hamilton (Anchorwatch), Calle (Cashu), James O'Beirne, and roughly 25 others — is systematically sweeping crucial code repositories for vulnerabilities and recommending patches. That's the new register. Don't trust, verify — and this time actually verify.