Coldcard Losses Reach $70M as the Advisory Expands to All Models and the Attacker Leaves a Paid-Account Trail

Galaxy Research mapped the Coldcard drain at 1,196 addresses emptied of 1,082.65 BTC, about $70.2 million, in a 41-minute window on July 30 — roughly double initial estimates. Coinkite expanded its advisory to affected firmware on all current models, reversing early analysis that cleared the Mk4, Mk5 and Q, and shipped emergency patches, with CEO Rodolfo Novak taking "full accountability" and suggesting the flaw may have been found using AI. Block engineers say the attacker used a paid account at an unnamed blockchain-services provider; authorities have been notified.