Coldcard Losses Approach $114 Million as Fourth Wave of Sweeps Hits Wallets

A fourth wave of attacks against bitcoin addresses generated by flawed Coldcard hardware wallets began early Monday and remained active hours later. Unlike earlier waves, researchers say this round uses replace by fee, a Bitcoin feature that allows a pending transaction to be overwritten by another paying a higher fee, meaning victims who spot their address in the unconfirmed transaction queue may still be able to move their funds first.

Running Total Nears $114 Million Across Four Waves

Galaxy Research firmwide research head Alex Thorn flagged the latest activity, noting the attack began July 30 with a sweep that took 1,083 bitcoin from nearly 1,200 addresses in just 41 minutes. Two further waves over the weekend pushed losses to 1,367 bitcoin. If the current wave holds, total losses across all four waves would reach roughly 1,816 bitcoin, or about $114 million, spread across more than 5,200 addresses.

Root Cause Remains a 2021 Firmware Flaw

The vulnerability stems from a March 2021 firmware update that mistakenly generated wallet seeds using a predictable software randomizer instead of the device’s dedicated hardware-based generator, making affected keys reproducible by attackers. Manufacturer Coinkite has released emergency firmware and urged users who generated seeds before the fix to transfer funds to a newly created wallet.

Pattern Suggests Targeted, Automated Sweeping

Thorn said the latest wave hit 462 addresses across 218 transactions at roughly 14 sweeps per block, about 45 times normal activity. Each transaction sent funds to a freshly created address unique to that victim, and none of the affected wallets involved multisignature setups, consistent with the flaw impacting only single key wallets.