Coldcard wallet attacks enter fourth wave, nearly 449 BTC swept
Security & Exploits ·
A blockchain researcher flagged a new round of thefts from vulnerable Coldcard-generated Bitcoin wallets, adding to three earlier waves already tied to a firmware flaw.
Blockchain researcher Alex Thorn identified 218 transactions across 462 suspected victim addresses, moving roughly 388.93 BTC into newly created destination wallets in a short window, according to CryptoPotato. Nearly 449 BTC in total was swept during this fourth wave, and Thorn urged affected users to move funds off vulnerable devices immediately and use higher transaction fees, noting that some pending transactions carry Replace-by-Fee flags that could give victims a brief window to outbid attackers before confirmation.
The activity follows three earlier waves already linked to the same weak-entropy issue in certain Coldcard firmware versions. Those prior waves drained 1,367 BTC from 4,585 addresses, with the funds still sitting unspent in attacker-controlled wallets, a pattern researchers say points to a coordinated operation rather than opportunistic theft.
The underlying flaw affects seeds generated on Coldcard firmware released after March 2021, with exposure spanning the Mk3, Mk4, Mk5 and Q device lines. Newer firmware halts the problem for future seed generation, but it cannot retroactively secure seeds already created under vulnerable conditions, meaning every single-signature address generated that way remains at risk of eventual drainage.
The pattern has drawn attention beyond the immediate victim addresses. WuBlockchain has covered the wave as part of the broader Coldcard incident, while Bloomberg has reported on the ongoing attacks against what is often treated as one of the more secure custody methods for Bitcoin holders. Separate on-chain tracking referenced in this post has also flagged movement tied to the incident.
What remains unresolved is the full scope of exposure among still-unmigrated wallets and whether law enforcement efforts will identify those responsible. Not all stolen funds have stayed dormant — at least one victim's BTC was routed through a cross-chain swap into an online casino, which reportedly required a police report before considering any freeze — raising questions about how much of the total drained BTC across all four waves will ultimately be recoverable or traceable.