The $130 million figure Galaxy Research has placed on the Coldcard hack is almost certainly not the final one. The firm said on X that Bitcoin losses tied to the incident could swell to that amount, then flagged the complication directly: a fourth wave of attacks remains unconfirmed, and Galaxy suspects the true total will be higher once it is included.
What Galaxy Research is flagging
Galaxy posted its assessment on X. The number it named is $130 million in potential Bitcoin losses from the Coldcard hack. The firm was explicit that it regards this as an incomplete picture. Galaxy said it suspects losses will prove greater once the yet-unconfirmed fourth wave of attacks is counted.
That framing is worth parsing. A firm that names a number and immediately questions its sufficiency is telling you the incident is still moving. The case for reading $130 million as a floor: Galaxy has already absorbed what is confirmed and is signaling there is more ahead.
The mechanism here is a sequence of attack waves, with the fourth still unconfirmed. Each wave presumably adds to the on-chain damage. How that fourth wave plays out determines whether the estimate holds or breaks higher.
The counterargument
Galaxy's read on a fourth wave is a suspicion, not a verified finding. That distinction carries weight. Until confirmation arrives, users and markets have no documented figure beyond what is already stated. The risk is that the feared escalation does not materialize and losses settle at the current estimate.
There is also a methodological question the source does not answer: what counts as a wave, who is determining the scope of each, and when does confirmation arrive. Galaxy's post on X is an assessment, not a formal audit. The underlying data behind the $130 million is not yet public.
The line to watch
Confirmation or denial of that fourth attack wave. On balance, the presence of multiple confirmed waves before it gives Galaxy's suspicion some grounding. If the fourth wave is confirmed, $130 million becomes the floor on $BTC losses tied to the Coldcard hack, and the ceiling remains unknown.