Coldcard Bitcoin Exploit Enters Suspected Fourth Wave With 462 Victim Addresses

Key Point

Galaxy Research head Alex Thorn warned early Monday that a likely fourth coordinated attack wave is targeting Coldcard users. Thorn identified 218 transactions between blocks 960,778 and 960,792 that moved over 380 BTC from 462 suspected victim addresses to 210 fresh destinations. The sweeps ran at 13.8 per block, about 45 times the pre-incident rate of 0.3, and Thorn said the transactions matched vulnerable Coldcard addresses. Onchain Lens said confirmed losses stand at $88.6 million after three confirmed waves linked to 1,367.05 BTC from 4,585 addresses. Coldcard said Sunday it halted shipments, destroyed remaining flawed firmware devices, and told users that patched firmware protects only newly generated seeds.

Why it matters: A wallet random number generator failure could force self-custody users to migrate funds quickly if more vulnerable addresses remain exposed.

Market Sentiment

Bearish, Stress-on, Tech-driven, Volatile.

Reason: The likely fourth attack wave against Coldcard users increases confidence stress around self-custody security.

Similar Past Cases

In August 2022, a Solana wallet-drain incident was traced to Slope, and CoinDesk reported that the exploit likely involved about $6 million in stolen funds from users. The episode showed that wallet-side key handling failures can trigger rapid user migration and custody distrust. (CoinDesk) Difference: Coldcard is a hardware-wallet case, and the current article frames the fourth wave as likely rather than confirmed.

Ripple Effect

A wallet RNG exploit can spread through confidence channels because users may treat older self-custody setups as unsafe until funds migrate to new seeds. If similar transactions keep appearing in the mempool, then fee competition and urgent migrations could increase congestion and user error risk. If Coldcard's outreach stabilizes the response, then spillover may stay limited to affected devices and exposed addresses.

Opportunities & Risks

Opportunities: If pending RBF fee races let victims outbid attacker transactions, then fast migration to fresh seeds can limit operational losses. If Coldcard releases clearer recovery coordination, then waiting for verified instructions can reduce user error risk.

Risks: If a verified fourth wave raises the final toll, then reducing exposed BTC kept on potentially vulnerable seeds is a defensive move. If second-hop wallet movement accelerates, then recovery odds may decline.