Coldcard Attack Wave 4: A Critical Recovery Window Amid $114 Million in Losses
As total losses reach $114 million with the fourth wave of attacks targeting Coldcard hardware wallet users, the Replace-By-Fee (RBF) feature offers victims a critical chance to recover their funds.
As security concerns mount in the cryptocurrency world, users of the popular hardware wallet Coldcard have faced a new wave of organized attacks. This fourth wave, identified by Galaxy Research Head of Research Alex Thorn, has brought the scale of the crisis to 1,816 Bitcoin (BTC). In this process affecting more than 5,200 addresses, a technical detail used by the attackers has opened an unexpected window of recovery for users.
The attack concentrated between blocks 960,778 and 960,792 on the Bitcoin network, reaching approximately 45 times normal activity levels. In this brief interval, 462 victim addresses were targeted across 218 transactions. At the core of the security vulnerability lies an error in a software update from March 2021. The device’s use of a predictable software system instead of a hardware random number generator led to the compromise of wallet keys by malicious actors.
Opportunity to Recover Funds with RBF
The attackers enabled the Replace-By-Fee (RBF) feature while executing their transactions. This technical feature allows an unconfirmed transaction to be overridden by a new transaction by paying a higher miner fee. If a user notices an unauthorized withdrawal from their address in the transaction queue, they can prioritize moving their assets to a secure address under their control by offering a higher fee than the attacker.
Coldcard manufacturer Coinkite has released an emergency software update for all affected models. Experts recommend that users immediately move the funds on their devices to secure wallets created with a new seed phrase. Danger symbols and warning signs appearing on device screens once again demonstrate the gravity of the situation. It is of utmost importance for victims to act quickly before transactions are permanently recorded on the blockchain.