Fourth Wave of Coldcard Attacks Sweeps 389 Bitcoin: Galaxy Analysis

Fourth Wave of Coordinated Attacks Emerges

A fourth wave of coordinated attacks targeting Coldcard Bitcoin hardware wallet users has emerged, with leading crypto research firm Galaxy documenting fresh theft patterns that underscore the severity of an unpatched firmware vulnerability affecting thousands of users worldwide.

The latest assault, meticulously analyzed by Galaxy’s research division, targeted 462 victim addresses through 218 separate transactions, collectively moving approximately 388.9 Bitcoin. The attack velocity was striking: transaction sweeps averaged 13.8 per block, roughly 45 times higher than baseline network activity observed in the pre-incident period. This elevated rate demonstrates the coordinated nature of the theft campaign.

Novel Attack Strategy and a Narrow Window for Recovery

Departing from typical theft patterns, attackers deployed distinct destination addresses for each victim rather than funneling assets into centralized collection wallets. This dispersal strategy makes tracking significantly more difficult while potentially obscuring the attacker’s operational methods.

Notably, not all malicious transactions have achieved final confirmation on the blockchain. Transactions lingering in the network mempool—the waiting area for unconfirmed transactions—create an unanticipated opportunity for vigilant victims. Users who retain control of their private keys can broadcast competing transactions with elevated fees to outbid attackers and move their funds to secure addresses before malicious transfers are validated. Galaxy highlighted this technical countermeasure as a potential lifeline for those positioned to act decisively.

The current assault follows an initial attack wave that struck on Thursday, establishing this as part of an ongoing campaign rather than an isolated incident. Some stolen Bitcoin have already been redirected to secondary addresses, suggesting attackers are implementing additional layering to complicate forensic analysis.

Firmware Weakness Exposes Thousands

These thefts stem from a previously undisclosed flaw in Coldcard’s firmware implementation that caused affected devices to generate private key seeds with insufficient entropy—essentially using inadequate randomness in the cryptographic process that creates Bitcoin addresses. This fundamental weakness undermined the security guarantees that hardware wallets are designed to provide.

Researchers estimate the flaw has compromised over 1,100 wallets, with cumulative losses across all attack waves exceeding $90 million in Bitcoin. The disclosure has raised significant concerns about hardware wallet security practices and the necessity for rigorous, continuous security evaluation of devices that serve as final custodians of digital assets.

Galaxy’s research suggests this represents an active, ongoing threat rather than a contained incident. The systematic nature of attacks across multiple waves indicates threat actors are methodically scanning for and exploiting vulnerable addresses. Users still holding assets on affected Coldcard devices face escalating exposure and should prioritize moving funds to alternative secure custody solutions. For the broader cryptocurrency market, the Coldcard incident exemplifies how firmware vulnerabilities can rapidly undermine confidence in custody solutions, directly impacting mainstream adoption strategies.

Source: Galaxy, via Cointelegraph. Not financial advice.