$88M in Bitcoin Swept from Over 4,500 Addresses in Suspected Coldcard Incidents

A series of suspected Coldcard-related bitcoin sweeps has expanded to an estimated $88.6 million, according to Galaxy Research. The incident appears to have occurred in three waves, with the first wave sweeping 1,082.65 BTC from 1,195 addresses in just 41 minutes on July 30. The second operation collected 76.16 BTC from 1,478 addresses the following day. The third wave stretched from July 31 into Aug. 1 and drained roughly 208 BTC from 1,912 addresses.

The third operation did not look like a simple continuation of the first two, as funds were sent into 293 separate P2WSH vaults, making it harder for outside observers to group the funds together.

Galaxy connected the activity to a vulnerable Coinkite Coldcard firmware release shipped on March 17, 2021. None of the affected coins were created before that release, and the median victim address had remained inactive for about 3.5 years, matching the behavior expected from long-term cold storage.