Suspected fourth wave of Coldcard attacks hits 462 addresses, 388.93 BTC involved

Odaily Planet Daily cites Galaxy's head of research as saying a coordinated attack targeting Coldcard wallets appears to be in progress, with additional similar transactions still awaiting confirmation in the mempool. Previously identified confirmed transactions show Replace-By-Fee (RBF) enabled. Data from blocks 960,778 to 960,792, spanning roughly 2.5 hours, indicates 218 transactions affecting 462 victim addresses and 216 newly created destination addresses, moving a total of 388.92748828 BTC. All transactions showed no inputs older than the Coldcard firmware boundary. During the same interval, the average sweep rate reached 13.8 sweeps per block, versus 0.3 sweeps per block in the pre-incident control window, a roughly 45x jump. The transaction pattern is largely 1:1, with each victim address mapping to a single new destination address; only one destination address received two sweeps, and no aggregation addresses were observed. Some funds have already been forwarded to second-hop addresses.