Suspected fourth wave of Coldcard attacks hits 462 addresses, 388.93 BTC involved
AI Market Summary
Research suggests an organized fourth wave of Coldcard-related thefts, with 388.93 BTC moved across 218 transactions impacting 462 victim addresses over ~2.5 hours. RBF usage and a ~45x jump in sweep frequency versus the control window indicate active, coordinated draining with some funds already progressing to second-hop addresses. The incident can weigh on near-term crypto risk sentiment via heightened security and custody concerns.
Impact level
● Medium
Affected assets
BTC/USDT-0.39%
AI Insight · BTC/USDTAI Insight
▼ Bearish
Trade now
⚠️ AI-generated insights are based on news content and are provided for informational purposes only. They do not constitute investment advice or represent the views of BingX. Investing involves risk. Please trade responsibly.
Odaily Planet Daily cites Galaxy's head of research as saying a coordinated attack targeting Coldcard wallets appears to be in progress, with additional similar transactions still awaiting confirmation in the mempool. Previously identified confirmed transactions show Replace-By-Fee (RBF) enabled.
Data from blocks 960,778 to 960,792, spanning roughly 2.5 hours, indicates 218 transactions affecting 462 victim addresses and 216 newly created destination addresses, moving a total of 388.92748828 BTC. All transactions showed no inputs older than the Coldcard firmware boundary.
During the same interval, the average sweep rate reached 13.8 sweeps per block, versus 0.3 sweeps per block in the pre-incident control window, a roughly 45x jump. The transaction pattern is largely 1:1, with each victim address mapping to a single new destination address; only one destination address received two sweeps, and no aggregation addresses were observed. Some funds have already been forwarded to second-hop addresses.
