Researchers flag 218 transactions moving 389 BTC from vulnerable Coldcard hardware wallets in a coordinated attack wave.
A suspected fourth wave of attacks on Coldcard Bitcoin hardware wallets has swept 388.9 BTC across 462 potential victim addresses. The activity, flagged by Galaxy research head Alex Thorn, involved 218 transactions averaging 13.8 sweeps per block—45 times higher than pre-incident rates.
Most transfers created fresh destination addresses for each victim rather than converging on a central wallet. Some funds have already been moved to secondary addresses, while unconfirmed transactions in the mempool may offer affected users a narrow window to secure their assets.
The attacks follow the disclosure of a previously undetected Coldcard firmware flaw, which exposed vulnerable devices to unauthorized access. Users controlling affected keys may still broadcast higher-fee transactions to redirect funds before attackers confirm theirs.