A fresh update from Galaxy Research reveals that confirmed losses stemming from the Coldcard wallet incident have now surpassed the $100 million threshold. The investigation has tracked 1,596 Bitcoin (BTC) stolen from roughly 7,300 addresses. These thefts occurred across three distinct major attack waves and an additional 14 smaller incidents.

On Monday, Galaxy Digital’s research arm said that 73 victims had made contact with its researchers. The reports from these victims helped corroborate the first three large-scale attacks and allowed investigators to identify what Galaxy termed smaller “footprints.” The firm suggested these could represent opportunistic attackers who were exploiting the same vulnerability.

Additionally, Galaxy Research has identified a suspected fourth wave of attacks that could potentially escalate the total losses to 2,055 BTC, which is worth around $130 million. However, Galaxy clarified that it has excluded this event from its confirmed estimate for the time being. The reason is a lack of confirmation from victims believed to have been affected in that wave. The research group stated it has “medium-high” confidence that this wave is largely composed of attacker activity.

According to Galaxy, 90% of the stolen Bitcoin has not been moved, a figure that includes the funds linked to the first three confirmed incidents. The firm also noted that both attacker and victim addresses have been shared with U.S. federal law enforcement, cryptocurrency exchanges, and companies specializing in cyber-investigation.

These new findings significantly increase Galaxy's previously confirmed total, which it published on Saturday, of 1,367 BTC traced across 4,585 addresses. Galaxy also issued a warning that the attacks are ongoing. It urged any Coldcard users with security concerns to migrate their funds to a safe address without delay.