New Coldcard Wallet Attack Hits Nearly 390 Bitcoin in Fourth Wave

A fourth wave of coordinated thefts has struck Coldcard hardware wallet holders, just days after the first attack was detected last Thursday. Galaxy research tracked 218 transactions affecting 462 wallets, moving close to 389 Bitcoin in a matter of hours.

Unusual Transaction Pattern Raises Red Flags

Analysts recorded roughly 13.8 sweeping transactions per block, a rate about 45 times higher than normal network activity. Unlike typical theft patterns, most stolen funds were sent to newly created addresses for each victim rather than one shared wallet, with some coins already moved a second time to hide their trail.

Some transactions remain unconfirmed in the mempool, meaning affected users who still hold their private keys could potentially outpace attackers by sending their funds elsewhere with a higher network fee.

Root Cause Traced to Firmware Flaw

The thefts stem from a Coldcard firmware bug that generated wallet seeds with weak randomness. Thousands of wallets are believed affected, with total losses now exceeding $90 million.