- Published on
Galaxy’s Thorn
- Authors
- Name
- DeepHorus
Galaxy research head Alex Thorn has issued a fresh warning about a suspected fourth wave of coordinated thefts targeting Coldcard Bitcoin hardware wallets. In an X post on Monday, Thorn flagged hundreds of transactions affecting 709 potential victim addresses, moving 448.7 Bitcoin. The activity comes just days after the first wave of attacks on Thursday, raising concerns about the ongoing vulnerability of Coldcard users.
This new wave follows the disclosure of a previously undetected firmware flaw in Coldcard devices, which caused affected hardware to generate wallet seeds with less entropy than intended. That flaw has already been linked to the theft of over $90 million in Bitcoin across thousands of wallets. The latest transactions suggest the problem is far from resolved, with attackers continuing to exploit the weakness.
Thorn reported that the average rate of sweeps was 13.8 per block, roughly 45 times higher than a pre-incident control window. Most transfers created a fresh destination address for each victim rather than pooling funds into a central collection wallet, a pattern that increases the difficulty of tracking. Some funds have already been moved into second-hop addresses, indicating an organized and deliberate effort.
The researcher expressed high confidence in his assessment, stating: “These are LIKELY Coldcard victims — they match the shape of coldcard vulnerable utxos and the elevated transaction pattern gives me high confidence they are another wave of attacks.” He also noted that similar transactions remain in the mempool awaiting confirmation, suggesting further thefts may be imminent.
For affected users who still control the relevant private keys, there may be a narrow opportunity to recover funds. Thorn advised broadcasting a conflicting transaction with a higher fee to move the Bitcoin to a secure wallet before the attacker’s transaction is confirmed. This requires prompt action, as unconfirmed transactions can be replaced under certain conditions.
The news underscores the broader risks facing hardware wallet users, even those considered highly secure. Coldcard has not yet issued a public statement regarding this latest wave, but the community is urging affected individuals to check their wallets and transfer funds immediately. Moving forward, firmware updates and new wallet generation will be critical for preventing further losses, though the current attacks reveal that many users remain exposed.
