Fourth Coldcard Attack Wave Detected, 389 More Bitcoin Stolen

A string of hacking attacks targeting the Coldcard Bitcoin hardware wallet has entered a fourth wave, expanding the losses.

Cointelegraph reported on August 2 that Alex Thorn, head of research at Galaxy, wrote on X that 218 transactions from 462 addresses believed to be affected had been recorded over the past several hours, moving about 388.9 Bitcoin.

The latest activity averaged 13.8 transfers per block, roughly 45 times the level seen during a prior control period. In most cases, a new destination address was created for each victim, and some of the funds have already been moved to second-hop addresses.

Thorn wrote that the transactions matched the pattern of vulnerable Coldcard UTXOs and showed abnormal behavior, indicating another wave of attacks. Similar transactions are also sitting in the mempool. Users who still control the private keys to affected addresses can broadcast a conflicting transaction with a higher fee before the attacker's transfer is confirmed and move their assets to a secure wallet, he added.

The attack stemmed from a vulnerability found in Coldcard firmware. The flaw caused some devices to generate wallet seeds with lower entropy than intended. More than 1,100 wallets have been affected so far, and the stolen Bitcoin is estimated at $90 million.