Galaxy Research flags possible fourth coordinated attack on Coldcard users, ~388.9 BTC moved

Alex Thorn, head of research at Galaxy Research, said signs point to a fourth coordinated attack wave targeting Coldcard users. Thorn reported that between blocks 960,778 and 960,792, 218 transactions moved about 388.9 BTC from 462 victim addresses to 216 newly created destination addresses. He said activity during the window was roughly 45 times higher than the pre-incident baseline, and some funds have already been swept to second-hop addresses. Similar transactions are still pending in the mempool. Confirmed transactions indicate Replace-by-Fee (RBF) opt-in, which may allow eligible users to increase fees and potentially reroute funds. Thorn urged users to move funds off Coldcard devices immediately and use higher fees. Galaxy Research previously identified three suspected attack waves involving Coldcard-generated addresses, affecting 4,585 addresses and draining 1,367.05 BTC, valued at about $88.6 million. Coldcard said it has halted shipments and destroyed all remaining COLDCARD devices running the vulnerable firmware. Satscard, Opendime, and Tapsigner are not affected. The patched firmware protects newly generated seeds, but users must create a new seed and transfer funds from any seed generated on the vulnerable firmware.