Coldcard Faces Fourth Organized Attack Wave—388.9 BTC Siphoned in Coordinated Blitz

Coldcard users are facing a fourth wave of organized theft, and the numbers are no longer rounding errors.

Alex Thorn, Head of Research at Galaxy Research, flagged a fresh burst of malicious activity that siphoned approximately 388.9 BTC from 462 victim addresses in just 14 blocks—between 960,778 and 960,792.

The attack generated 218 transactions funneling bitcoin into 216 previously unseen destinations. Transaction volume spiked to roughly 45 times the pre-incident baseline, leaving little doubt that this was a deliberate, structured operation.

The warning came via the original report, which also notes that some of the stolen funds have already been traced to second-hop addresses. Similar transactions remain pending in the mempool, indicating the sweep isn’t fully processed.