The reported damage from a hack involving Coldcard hardware wallets has reached $130 million, according to a Yahoo Finance report.

Coldcard is a Bitcoin-focused hardware wallet line widely used by individual holders as well as small and midsize custody operations for offline private-key storage. The wallet is routinely referenced in cold-storage best-practice guides for retail and institutional bitcoin holders.

The headline figure

Yahoo Finance's headline places the cumulative damage tally at $130 million. The wording "reaches" indicates the figure is an updated running total rather than a static estimate, suggesting investigators are still cataloguing affected addresses or victim reports. The dollar value exceeds user-reported losses from several earlier hardware-wallet security incidents, including prior phishing campaigns targeting seed phrases and isolated device-tampering cases tracked by manufacturers.

What remains unclear

The Yahoo Finance report referenced in available coverage does not specify whether the $130 million refers to direct theft from compromised wallets, downstream losses from related phishing operations, or an aggregated total combining on-chain and off-chain losses. The report does not attribute the figure to a specific blockchain-analytics firm, court filing or law-enforcement action.

The attack vector — whether tied to supply-chain interdiction, firmware manipulation, or user-side compromise — also remained unspecified in the headline coverage. That determination will shape both the manufacturer response and the broader hardware-wallet market.

Coldcard in the custody stack

Coldcard operates as a single-purpose device dedicated to bitcoin key management. It integrates with Bitcoin-specific wallets such as Sparrow and Electrum and supports Partially Signed Bitcoin Transactions, a workflow that moves unsigned transactions between offline and online environments for signing.

Compromises affecting hardware wallets typically fall into three categories:

• Supply-chain interdiction, where devices are tampered with in transit
• Firmware-level manipulation prior to delivery
• User-side compromise, often through counterfeit devices or phishing

The category applicable to this incident will determine whether the risk affects already-shipped devices in the field, future shipments, or only buyers exposed through unofficial channels.

Operational read-through

Custody providers and treasury teams running multi-signature setups with Coldcard devices will likely review firmware verification procedures and device-procurement channels in the near term. Buyers currently receiving new units are advised to confirm tamper-evident packaging and to validate firmware signatures directly on-device before initial use.

Outlook

Further detail is expected as blockchain analysts publish on-chain breakdowns and as the manufacturer addresses the incident through its standard disclosure channels. The next 72 hours are likely to determine whether the $130 million figure stabilizes, grows, or is revised downward as the scope of the compromise becomes clearer.