Suspected 4th Coldcard attack wave sweeps 389 Bitcoin: Galaxy’s Thorn
New coordinated thefts are targeting Coldcard Bitcoin hardware wallet users, following an earlier wave days before. Galaxy research head Alex Thorn reported 218 transactions affecting 462 possible victim addresses and moving about 388.9 BTC. The pattern is far above normal, with roughly 13.8 sweeps per block, about 45 times a pre-incident baseline. Many transfers create a fresh destination for each victim instead of using one collection wallet, and some funds have already been moved again into second-hop addresses. Thorn said the transactions likely involve Coldcard victims because they match vulnerable UTXO patterns and the elevated activity strongly suggests another attack wave. Similar transactions are also pending in the mempool. Users who still control the relevant keys may be able to race the attacker by broadcasting a higher-fee conflicting transaction to move funds to safety first. The attacks follow disclosure of a Coldcard firmware flaw that reduced seed entropy, with more than 1,100 wallets affected and about $90 million in Bitcoin reportedly stolen.
