4th Coldcard Wave Sweeps 389 BTC in Coordinated Theft

Woofun AI reports that Galaxy research head Alex Thorn identified a fourth wave of coordinated thefts targeting Coldcard hardware wallets, marking a rapid escalation in security breaches. This latest incident emerged just days after the initial attack wave on Thursday, highlighting the persistent vulnerability of specific hardware devices.

On Monday, Thorn flagged 218 transactions impacting 462 potential victim addresses, moving approximately 388.9 Bitcoin (BTC) within hours. The activity averaged 13.8 sweeps per block, a rate 45 times higher than the pre-incident control window. Per Woofun AI, the data shows funds were dispersed to fresh destinations rather than central wallets, with some already moved to second hop addresses while similar transactions lingered in the mempool.

The root cause is a previously undetected firmware flaw that caused affected devices to generate wallet seeds with less entropy than intended. Current estimates indicate over 1,100 wallets are impacted, raising total losses to $90 million, up from a prior $70M estimate. Affected users controlling relevant keys can broadcast a conflicting transaction with a higher fee to secure their funds before confirmation.

Thorn expressed high confidence that these are Coldcard victims, citing the match with vulnerable utxos and the elevated transaction pattern. This coordinated theft underscores the critical risk facing Bitcoin hardware wallets when underlying cryptographic integrity is compromised.