Coldcard Bitcoin Exploit Enters Fourth Wave With 462 New Suspected Victims

Galaxy Research head Alex Thorn warned early Monday that a fourth coordinated attack wave is likely targeting Coldcard users. The random number generator (RNG) exploit has been linked to 1,367.05 Bitcoin (BTC) from 4,585 addresses across three confirmed waves.

A verified fourth wave would push totals higher. Coldcard Exploit Deepens as Suspected Fourth Wave Sweeps Over 380 Bitcoin Thorn identified 218 transactions between blocks 960,778 and 960,792, moving over 380 BTC from 462 suspected victim addresses to 210 fresh destinations.

Sweeps ran at 13.8 per block, roughly 45 times the pre-incident rate of 0.3. The transactions matched the pattern of vulnerable Coldcard addresses, with some funds already swept to second-hop wallets.

“These are LIKELY Coldcard victims — they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks,” Thorn said.