Coldcard Sweep Attacks Enter Fourth Wave, Estimated Losses Near $114M

Attackers have launched a fourth round of sweeps targeting bitcoin stored in Coldcard hardware wallets, pushing estimated losses to about $114 million since Thursday. Alex Thorn, Galaxy's head of firmwide research, said the latest wave saw 448.7 BTC swept from 709 addresses believed to be potential victims. Coinkite has issued emergency firmware updates for all affected Coldcard models, paused shipments, and urged users to move funds to newly generated seeds. Block's Bitcoin Engineering and Security teams traced the issue to a March 1, 2021 code commit that redirected seed generation to MicroPython's Yasmarang software randomizer. Coinkite CEO Rodolfo Novak said anyone who generated a seed on a Coldcard should move funds immediately. Why it matters: A flaw in wallet seed generation can undermine confidence in self-custody and trigger rapid fund migration if users believe private keys can be guessed. Market sentiment: Bearish; stress-on; event-driven; de-risking. The roughly $114 million in estimated Coldcard-linked losses since Thursday signals acute custody stress for impacted bitcoin holders. Similar past case: The Atomic Wallet compromise in June 2023 prompted reports of more than $35 million stolen; Atomic Wallet later said fewer than 1% of monthly active users were affected (Cointelegraph). Unlike Atomic Wallet, the Coldcard incident centers on hardware-wallet seed generation rather than a software wallet. Ripple effects: Weak entropy in seed generation can turn custody risk into an urgent migration problem if attackers can reproduce private keys. Continued replaceable sweep transactions in the mempool would indicate whether victims are racing attackers or the wave is slowing. Hardware-wallet makers may face tighter scrutiny of firmware review and entropy design. Opportunities & risks: - Opportunities: If emergency firmware and freshly generated seeds halt further sweeps, restored self-custody confidence could become a stabilization signal for affected Bitcoin users. - Risks: If replaceable sweep transactions keep appearing in the mempool, quickly moving funds to newly generated seeds remains the primary risk-reduction measure.