Wave 4 Alert for Coldcard: 388.9 Bitcoin Across 462 Addresses At Risk

A fourth organized attack wave targeting users of the popular hardware wallet manufacturer Coldcard has been detected, putting approximately 388.9 Bitcoin (BTC) at risk.

Galaxy Research Head of Research Alex Thorn announced that investors using Coldcard wallets are facing a new organized attack wave. According to investigations, suspicious transactions occurring between blocks 960,778 and 960,792 on the Bitcoin network reveal that significant amounts of assets from hundreds of victim addresses are being transferred to new wallets.

The scale of the attack has reached a level approximately 45 times higher than normal network activity. While assets were withdrawn from 462 victim addresses via 218 transactions, it was observed that some of the stolen funds have already been transferred to second-stage addresses. Experts warn users that funds can be recovered for unconfirmed transactions by using RBF (Replace-by-Fee)—a feature that allows paying a higher commission for faster confirmation by miners—to divert the funds back to safety.

Critical Security Warning for Coldcard Users

This latest incident has been recorded as the fourth major wave targeting Coldcard addresses. In previous attacks, 4,585 addresses were affected, and 1,367.05 Bitcoin (BTC) worth approximately $88.6 million was stolen. Although the company announced that it has stopped shipping devices with the vulnerable firmware and destroyed existing stock, wallets created with the old firmware still carry a high risk.

Users wishing to protect themselves from the vulnerability must update their devices to the latest firmware version and create a new seed phrase to move their assets. While it was stated that other products like Satscard and Opendime are unaffected, it is vital to immediately transfer funds from old wallets created with risky firmware to a secure address.