Coldcard’s Suspected Fourth Attack Wave: Why Are 462 Addresses Still Being Swept?
Galaxy Head of Research Alex Thorn has identified what appears to be a fourth organized wave of Bitcoin theft involving seeds generated by affected Coldcard firmware. During the approximately 2.5-hour period between blocks 960,778 and 960,792, researchers observed 218 transactions involving 462 suspected victim addresses, 216 new destinations, and 388.92748828 BTC. Similar transactions reportedly remained in the mempool, while confirmed transactions had replace-by-fee, or RBF, enabled.
2026/08/03