A suspected fourth attack wave moved nearly 389 Bitcoin (BTC) from 462 addresses linked to Coldcard’s firmware flaw, Galaxy Research said Monday.
Key Points:
- Researchers identified 218 transactions that moved about 388.93 BTC from 462 suspected victim addresses.
- Earlier confirmed waves had already drained 1,367.05 BTC from 4,585 addresses, worth about $88.6 million.
- Coldcard stopped shipments, destroyed vulnerable inventory and told users to generate fresh seeds before moving funds.
Coldcard Bitcoin Sweep
Alex Thorn, Galaxy Research’s head of research, identified 218 transactions between blocks 960,778 and 960,792 that moved 388.93 BTC from 462 suspected victim addresses. The activity unfolded over about 2.5 hours. Sweeps averaged 13.8 per block, around 45 times the pre-incident rate of 0.3, while some funds had reached second-hop wallets.
“These are likely Coldcard victims,” Thorn said, adding that the transaction pattern gave him “high confidence” another coordinated attack wave was underway. The suspected fourth wave was not formally confirmed when he issued the warning Monday morning.
Thorn said similar transactions remained in Bitcoin’s mempool with replace-by-fee enabled, allowing an unconfirmed payment to be replaced by another carrying a higher fee. That feature could let a victim outbid an attacker before miners confirm either transaction.
Coldcard said Sunday it stopped shipments and destroyed remaining inventory carrying the flawed firmware. Patched software protects only seeds generated after installation, so exposed users must create a fresh seed and move their funds. The company asked victims to retain affected devices while its legal team coordinates with law enforcement.
Also Read: Astra Versus Claude Opus 5: One Splits The Problem, One Holds The Context
Bitcoin Wallet Risk
Onchain Lens placed confirmed losses from the first three waves at $88.6 million. One Canadian holder reportedly lost $1.6 million within minutes.
Changpeng Zhao, the Binance founder known as CZ, warned that established hardware wallets can contain bugs and suggested distributing holdings across several devices. He acknowledged that dividing funds creates different risks.
Coldcard said hardware wallet makers, researchers and self-custody specialists offered resources as the company responded.
The team said it was “committing to work with the broader industry going forward,” a pledge that could influence wallet testing and disclosure.
The first major sweep on Jul. 30 drained 1,082.65 BTC from 1,196 addresses in 41 minutes, before two later waves pushed confirmed losses to 1,367.05 BTC across 4,585 addresses. Coldcard said Satscard, Opendime and Tapsigner use different code and were not affected.
Read Next: Why Ethereum Keeps Only 4.9% Of What Its Applications Actually Make