Coldcard Faces Suspected Fourth Coordinated Attack Wave as Estimated Losses Rise

Galaxy Research head Alex Thorn said blockchain data suggests Coldcard users may be experiencing a fourth organized attack wave as of August 3, with an estimated 448.7 BTC moved from 709 wallets believed to belong to victims. Thorn said his assessment is based on on-chain analysis rather than device logs. He described the impacted addresses as "likely Coldcard victims," citing transaction patterns and unspent outputs consistent with the vulnerable wallet behavior. Galaxy's initial snapshot covered blocks 960,778 to 960,792 and found 218 transactions totaling 388.9 BTC tied to 462 potential victim addresses. An updated pass expanded the estimate to hundreds of transactions totaling 448.7 BTC across 709 potential victim addresses. In a post on X, Thorn warned that similar transactions were still sitting in Bitcoin's mempool awaiting confirmation and that previously confirmed transactions signaled opt-in Replace-by-Fee (RBF). He urged holders to check funds, noting that an affected user who still controls the key may be able to broadcast a conflicting transaction with a higher fee to move funds to a secure wallet. He cautioned that once a transaction is confirmed in a block it can no longer be replaced, and even before confirmation a replacement attempt is not guaranteed to succeed. Thorn said Galaxy measured about 13.8 "sweeps" per block during the suspected wave, a roughly 45x jump from 0.3 sweeps per block during a pre-incident control period. He added that the siphoned funds were routed to a new address rather than a shared wallet, and some funds were later moved again, complicating tracking. Galaxy has previously mapped three earlier waves totaling 1,367.05 BTC taken from 4,585 addresses, including a first wave that targeted 1,082.05 BTC across 1,196 addresses. With the latest estimate, the cumulative tally rises to 1,815.75 BTC across 5,294 addresses. The figures have not been confirmed by authorities, Coinkite, or wallet owners, and it remains unclear whether a single actor is behind all four waves. The issue traces to an RNG integration error introduced during a March 2021 firmware change. Coinkite estimates affected Mk2 and Mk3 seeds have about 40 bits of effective entropy, while seeds generated on affected Mk4, Mk5, and Q releases have 72 bits rather than 128. Block's engineering team reported the firmware called a deterministic MicroPython fallback instead of the hardware random-number generator, while noting exploitability could not be confirmed without full empirical testing. Coinkite has released firmware updates: version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, and 6.6.0X or 6.6.0QX for Edge releases. Coinkite said updating firmware alone does not fully resolve the risk. After updating, users should generate a new seed, verify the receiving address, send a test transaction, and then migrate the full balance. Coinkite also said seeds created with at least 50 fair, private dice rolls are not considered at risk, and that a unique BIP39 passphrase can provide an additional layer of protection, though it still recommended completing a full migration. The advisory does not apply to TAPSIGNER, OPENDIME, and SATSCARD, which use separate codebases. Disclaimer: This article is for informational purposes only and does not constitute legal, tax, investment, financial, or other advice.