A potential fourth attack wave targets Coldcard hardware wallet users, draining 388.9 BTC in recent transactions amid heightened activity.
A suspected fourth organized attack wave has targeted Coldcard hardware wallet users, moving approximately 388.9 BTC across 218 transactions. The activity, detected between blocks 960,778 and 960,792, involved 462 victim addresses and 216 new destination addresses, with transaction volume surging 45 times above baseline levels.
Previous attack waves affected 4,585 addresses and drained 1,367.05 BTC, valued at $88.6 million. Coldcard halted shipments and destroyed devices with vulnerable firmware, while unaffected products include Satscard, Opendime, and Tapsigner. Patched firmware protects new seeds, but users must migrate funds from compromised seeds.
Some stolen funds have already been swept to second-hop addresses, and pending transactions remain in the mempool. Users are advised to move funds off Coldcard devices immediately and use higher fees, with RBF offering a potential recovery option for eligible transactions.