Galaxy Research put confirmed Coldcard exploit losses above $100 million across three verified waves plus fourteen smaller incidents, with a suspected fourth wave that could push the total near $130 million. The firm drew a careful line between what it has verified on-chain and what it merely suspects, and cautioned that the attack is still active. Roughly 90% of the stolen coins have not moved and remain traceable, which leaves a real, if narrow, path to recovery.